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Securing  General  Aviation 


Summary 

General  aviation  (GA)  -  a  catch-all  category  that  includes  about  57%  of  all 
civilian  aviation  activity  within  the  United  States  -  encompasses  a  wide  range  of 
airports,  aircraft,  and  flight  operations.  Because  GA  plays  a  small  but  important  role 
in  the  U.S.  economy,  improving  upon  GA  security  without  unduly  impeding  air 
commerce  or  limiting  the  freedom  of  movement  by  air  remains  a  significant 
challenge.  However,  policymakers  have  received  mixed  signals  about  the  relative 
security  risk  posed  by  GA,  due  to  its  diversity  and  a  general  lack  of  detailed 
information  regarding  the  threat  and  vulnerability  of  various  GA  operations.  While 
some  recent  high-profile  breaches  of  GA  security  point  to  persisting  vulnerabilities 
and  limited  intelligence  information  suggests  a  continued  terrorist  interest  in  using 
GA  aircraft,  it  is  evident  that  GA  airports,  aircraft,  and  operations  vary  significantly 
with  regard  to  security  risk.  While  the  small  size  and  slow  speed  of  most  GA  aircraft 
significantly  limits  the  risk  they  pose,  some  experts  still  fear  that  they  could  be  used 
as  a  platform  for  a  chemical,  biological,  radiological,  or  nuclear  attack.  Certain 
sectors  of  GA  such  as  crop  dusters  and  larger  business  aircraft  present  more  specific 
risks  because  of  their  unique  capabilities  and  aircraft  characteristics. 

Because  various  segments  of  GA  differ  significantly  in  terms  of  their  perceived 
risk,  mitigation  strategies  should  arguably  be  tailored  to  some  degree  based  on  risk. 
In  step  with  the  premise  that  security  measures  should  be  predicated  on  assessments 
of  risk,  a  provision  in  the  FY2006  Department  of  Homeland  Security  Appropriations 
Act  (P.L.  109-90)  requires  the  DHS  to  examine  the  vulnerability  of  high-risk  sites  to 
possible  terrorist  attacks  using  GA  aircraft.  Based  on  an  analysis  of  risk,  a  variety  of 
options  exist  for  mitigating  security  risks  that  can  be  tailored  to  specific  GA  airports 
and  operations.  These  include  surveillance  and  monitoring;  airport  access  controls; 
background  checks  and  vetting  of  pilots,  airport  workers,  and  others  having  access 
to  GA  facilities;  and  physical  protections  for  airports  and  aircraft.  Steps  may  also  be 
taken  to  address  unique  security  risks  in  agricultural  aviation,  at  flight  schools,  and 
among  business  and  charter  operators.  Besides  these  steps  to  enhance  GA  security 
at  airport  and  operator  sites,  homeland  security  efforts  since  9/11  have  focused 
extensively  on  restricting  access  to  airspace  around  sensitive  locations.  These 
airspace  restrictions  have  been  highly  contentious  because  they  have  a  direct  impact 
on  the  freedom  of  movement  by  air,  they  are  costly  and  resource  intensive  to 
implement  effectively,  and  their  effectiveness  in  preventing  terrorist  attacks  in  some 
cases  is  thought  to  be  questionable. 

GA  security  has  remained  a  topic  of  considerable  interest  in  the  109lh  Congress. 
In  addition  to  the  requirement  to  assess  risks  posed  by  GA  aircraft  called  for  in  P.L. 
109-90,  both  H.R.  2649  and  H.R.  3397  propose  options  to  enhance  GA  security. 
Addressing  lingering  concerns  over  restricted  airspace  violations  in  the  Washington, 
DC  area  that  complicate  the  task  of  protecting  sites  from  aerial  attack,  H.R.  3465 
calls  for  increased  penalties  for  violators  and  mandatory  training  for  pilots.  GA  user 
groups  have  largely  opposed  these  measures,  calling  instead  for  a  risk-based 
approach  to  GA  security  that  they  maintain  does  not  unduly  impede  air  commerce  or 
compromise  aviation  safety.  This  report  will  be  updated  as  needed. 
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Securing  General  Aviation 


When  the  term  general  aviation  (GA)  is  mentioned,  the  image  most  likely  to  be 
conjured  is  one  of  a  small  single-engine  airplane  droning  over  America’s  farmland 
on  a  tranquil  summer’s  day.  In  the  post-9/1  lcontext,  this  pastoral  image  of  GA  has 
been  tarnished  to  a  degree  by  knowledge  that  the  9/11  hijackers  trained  in  small 
general  aviation  aircraft  in  the  United  States  and  amid  lingering  concerns  that  GA 
aircraft  could  be  used  in  a  future  terrorist  attack.  While  some  recent  high-profile 
breaches  of  GA  security  have  pointed  to  persisting  vulnerabilities,  and  limited 
intelligence  information  may  suggest  a  possible  terrorist  “fixation”1  on  using  aircraft 
to  attack  U.S.  interests,  GA  aircraft  vary  significantly  with  regard  to  the  risks  they 
pose.  The  threats  and  vulnerabilities  of  a  small  single-engine  airplane  operating  in 
rural  settings  is  intuitively  quite  different  than  the  risk  characteristics  of  large 
business  jets  operating  in  and  near  major  metropolitan  areas.  Most  experts  agree  that 
an  adaptive  approach  to  securing  GA  aircraft  and  airports  that  takes  into  account  the 
unique  risk  characteristics  of  the  various  distinct  components  of  GA  is  needed  to 
assure  that  security  needs  are  adequately  met  and  balanced  with  economic 
considerations  of  the  GA  industry.2 

Policymakers  have  received  mixed  signals  about  the  relative  risk  posed  by 
general  aviation.  While  the  9/11  Commission  asserted  that  “[mjajor  vulnerabilities 
still  exist  in  ...general  aviation  security,”3  the  commission  did  not  further  elaborate 
on  the  nature  of  those  vulnerabilities  nor  did  it  make  specific  recommendations 
pertaining  to  GA  security.  The  FAA  has  noted  that  “ [  w  ]  h  i  1  e  the  DHS  has  no  specific 
information  that  terrorist  groups  are  currently  planning  to  use  general  aviation  (GA) 
aircraft  to  perpetrate  attacks  against  the  United  States,  it  remains  concerned  that  (in 
light  of  completed  and  ongoing  security  enhancements  for  commercial  aircraft  and 
airports)  terrorists  may  turn  to  GA  as  an  alternative  method  for  conducting 
operations.”4  In  other  words,  while  GA  aircraft  and  airports  may  not  be  optimally 
suited  for  terrorist  objectives,  the  hardening  of  commercial  operations  may  make 
them  an  attractive  alternative  to  terrorists  seeking  to  identify  and  exploit 


1  See  Associated  Press.  “U.S.  Uncovers  Al-Qaida  Plot  in  Pakistan;  The  Terrorist  Group 
Allegedly  Planned  to  Fly  an  Airplane  into  the  American  Consulate.”  Telegraph-Herald 
(Dubuque,  Iowa),  May  3,  2003,  p.  A7. 

2  See  Report  of  the  Aviation  Security  Advisory  Committee  Working  Group  on  General 
Aviation  Airport  Security  (October  1,  2003);  and  Transportation  Security  Administration, 
Security  Guidelines  for  General  Aviation  Airports.  Information  Publication  A-001  (May 
2004). 

3  National  Commission  on  Terrorist  Attacks  Upon  the  United  States.  The  9/11  Commission 
Report.  New  York:  W.W.  Norton  &  Co.,  p.  391. 

4  Federal  Aviation  Administration.  “Washington,  DC  Metropolitan  Area  Special  Flight 
Rules  Area;  Proposed  Rule.  ”  Federal  Register(70)  149  (August  4,  2005),  p.  43251. 
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vulnerabilities  in  aviation  security.  In  this  context,  GA  airports  and  aircraft  are 
viewed  as  comparatively  soft  targets  that  may  be  exploited  by  terrorists  because  of 
known  weaknesses  and  vulnerabilities.  This  view  focuses  primarily  on  the 
vulnerability  of  general  aviation  and  does  not  systematically  assess  risk  with  regard 
to  the  interaction  between  these  vulnerabilities,  the  threat  posed  by  GA  aircraft,  and 
the  potential  consequences  of  a  terrorist  attack  using  GA  aircraft .  In  fact,  there  is 
considerable  debate  over  the  threat  element  of  the  risk  equation  for  GA  operations. 
While  GA  advocates  argue  that  the  threat  is  minimal,  some  policymakers  and 
security  experts  have  expressed  concern  that,  to  the  contrary,  GA  may  pose  a 
significant  security  threat.  Part  of  the  difficulty  in  resolving  this  debate  is  the 
diversity  of  operations  and  aircraft  types  that  make  up  GA,  making  a  single  threat 
assessment  for  all  sectors  of  the  GA  industry  arguably  inappropriate.  To  put  the 
threat  into  context,  the  following  discussion  provides  an  overview  of  the  variety  of 
aircraft  types,  flight  operations,  and  airport  characteristics  that  make  up  GA.  This 
discussion  is  followed  by  an  analysis  of  the  existing  vulnerabilities  in  GA  security, 
the  terrorist  threat  posed  by  GA  aircraft,  and  how  these  elements  factor  into  a  risk- 
based  assessment  of  GA  security.  Based  on  this  analysis,  possible  approaches  to  GA 
security  are  discussed  and  ongoing  initiatives  and  legislative  proposals  currently 
under  consideration  are  reviewed. 


What  is  General  Aviation? 

In  a  sense  general  aviation  (GA)  is  a  catch-all  phrase  that  encompasses  about 
57%  of  all  civil  aviation  activity  within  the  United  States,  measured  in  terms  of 
overall  flight  hours.5  Therefore,  it  is  often  easier  to  frame  general  aviation  in  terms 
of  what  it  is  not  rather  than  what  it  is.  In  this  context,  GA  refers  to  most  aviation 
operations  not  conducted  by  scheduled  passenger  airlines,  large  air  cargo  operators, 
or  the  military.  To  add  to  the  confusion,  commercial  charter  operations  are  often 
grouped  in  with  GA  and  non-revenue  flights,  such  as  maintenance  test  flights  and 
repositioning  flights  conducted  by  passenger  and  cargo  airlines,  are  usually  operated 
under  regulations  often  regarded  as  “general  aviation”  flight  rules.6  Thus,  virtually 
all  flight  activity  outside  the  scope  of  scheduled  passenger  or  cargo  air  carrier  flights 
and  military  operations  may  be  considered  GA.  This  encompasses  a  wide  variety  of 
aircraft  types  and  flight  operations.  Table  1  shows  the  distribution  of  aircraft  and 
flight  operations  formally  categorized  as  GA. 

General  Aviation  Flight  Operations 

As  indicated  in  Table  1,  recreational  flying  in  personal  aircraft  (personal  flying) 
and  flight  instruction,  the  typical  activities  one  might  expect  to  see  at  a  small  to  mid- 


5  CRS  calculations  based  on  Federal  Aviation  Administration.  FAA  Aerospace  Forecasts 
-  Fiscal  Years  2005-2016.  March  2005. 

6  The  set  of  regulations  specified  in  Title  14,  Code  of  Federal  Regulations,  Part  9 1  -  General 
Operating  and  Flight  Rules,  apply  to  all  civil  aircraft  operating  in  the  national  airspace 
system.  Like  GA  aircraft,  non-revenue  airline  flights  are  subject  to  these  rules,  but  are  not 
subject  to  additional  safety  and  security  regulations  specifically  applicable  to  revenue  air 
carrier  operations. 
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sized  GA  airport,  comprises  slightly  more  than  half  of  all  GA  operations  and 
accounts  for  about  75%  of  all  aircraft  in  the  total  GA  fleet.  Business  and  corporate 
flying  -  which  encompasses  anything  from  small  businesses  flying  cancelled  checks 
or  regional  salesmen  flying  to  customer  sites  in  small  single-engine  aircraft,  to 
companies  ferrying  crews  to  offshore  oil  rigs  by  helicopter,  to  operations  of  large 
corporate  jets  and  professionally  managed  fractional-ownership  fleets  -  makes  up 
about  one-quarter  of  all  GA  operations.  On-demand  charter  services,  referred  to  as 
air  taxi  services,  and  air  tours  are  also  considered  GA  operations  and  make  up  about 
5%  of  all  general  aviation  operations.  In  addition  to  these  major  categories,  there  are 
a  wide  variety  of  additional  GA  operations  such  as  aerial  advertising  (banner  towing 
and  skywriting),  aerial  application  (crop-dusting),  aerial  photography,  mapping  and 
data  collection,  traffic  reporting,  air  ambulance  and  medical  evacuation,  and  search 
and  rescue,  that  account  for  the  remaining  14%  of  all  GA  operations. 


Table  1.  U.S.  General  Aviation  Fleet  and  Activity 


CATEGORY 

Number  of 
Aircraft 

Percent  of 
GA  Fleet 

Hours 

Flown 

(Millions) 

Percent  of 
Operations 

Corporate 

10,500 

5.0 

3.2 

11.7 

Business 

25,000 

11.9 

3.4 

12.4 

Personal 

146,700 

70.0 

11.3 

41.2 

Instructional 

12,700 

6.1 

16.1 

Air  Taxi/Charter 

2,600 

1.2 

1.2 

4.4 

Air  Tours 

200 

0.1 

0.2 

0.7 

Aerial  Application 

3,300 

1.6 

1.1 

4.0 

Aerial  Observation 

4,200 

2.0 

1.3 

4.7 

Aerial  Other 

800 

0.4 

0.1 

0.4 

External  Load 

200 

0.1 

0.1 

0.4 

Other  Work 

1,700 

0.8 

0.4 

1.5 

Sightseeing 

900 

0.4 

0.2 

0.7 

Medical  Services 

900 

0.4 

0.5 

1.8 

TOTAL 

209,700 

100.0 

27.4 

100.0 

Source:  U.S.  Department  of  Transportation,  Federal  Aviation  Administration. 
Administrator’ s  Fact  Book  (August  2005). 
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General  Aviation  Aircraft  Types 

Because  of  the  diversity  of  operations  considered  under  the  broad  definition  of 
general  aviation,  GA  encompasses  a  wide  spectrum  of  aircraft  types.  Registered 
general  aviation  aircraft  in  the  United  States  -  numbering  about  210,000  -  range  in 
size  and  purpose  from  very  light  sport  aircraft  with  maximum  takeoff  weights  of  less 
than  1,320  pounds  used  strictly  for  recreational  flying  to  very  large  business  jets 
weighing  more  than  100,000  pounds  used  for  long-range  transcontinental  and 
international  travel.  The  composition  of  the  current  GA  fleet  is  shown  in  Figure  1. 
Single-engine  piston  aircraft  make  up  the  large  bulk  of  the  fleet  (69%).  The  large 
majority  of  these  aircraft  are  comparably  small  in  size,  most  weighing  less  than  5,000 
pounds  maximum  takeoff  weight  including  payload.  Experimental  aircraft,  mostly 
small  home-built  airplanes,  make  up  an  additional  10%  of  the  current  fleet.  Thus, 
while  GA  is  quite  diverse,  the  typical  image  of  a  GA  aircraft  as  a  small,  light,  single¬ 
engine  airplane  is  an  accurate  portrayal  of  the  large  majority  (about  75%)  of  the  GA 
fleet. 


Figure  1.  The  General  Aviation  Fleet 


Source:  Federal  Aviation  Administration.  FAA  Aerospace  Forecasts  -  Fiscal 
Years  2005-2016.  March  2005. 

Although  turbojet  aircraft  are  a  fast-growing  segment  of  the  GA  fleet,  they 
comprise  only  about  4%  of  the  current  GA  fleet,  and  this  is  not  expected  to  change 
much  over  the  next  10  years.  Nonetheless,  the  growing  number  of  turbojet  aircraft 
has  important  implications  for  GA  security  as  these  heavier,  faster,  and  more  capable 
aircraft  become  more  and  more  prevalent.  While  the  numbers  of  piston  aircraft  are 
expected  to  remain  flat  and  the  numbers  of  GA  turboprops  are  expected  to  grow  only 
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slightly  (about  1.3%  annually),  the  numbers  of  GA  turbojets  is  forecast  to  grow  at  a 
brisk  pace  of  about  6%  per  year  over  the  next  ten  years.  By  2016  it  is  expected  that 
there  will  be  almost  16,000  GA  turbojets  in  service  in  the  United  States  compared  to 
about  8,750  today.7 

While  the  numbers  of  GA  turbojets  is  expected  to  increase  dramatically  over  the 
next  10  years,  it  is  important  to  bear  in  mind  that  small,  single-engine  aircraft  will 
remain  the  large  majority  of  the  GA  fleet  by  2016.  The  FAA  expects  that  over  the 
next  10  years,  propeller  driven  single-engine  airplanes,  two-seat  light  sport  aircraft, 
and  small  home -built  experimental  airplanes  will  continue  to  make  up  more  than 
75%  of  the  GA  fleet.8  Security  experts  recognize  that  both  the  threats  and 
vulnerabilities  of  these  smaller  aircraft  are  significantly  different  than  the  threats  and 
vulnerabilities  of  medium  and  large  sized  GA  turbojets  and  turboprops.  Another 
segment  of  the  GA  industry  is  helicopters  (rotorcraft),  which  make  up  only  about  3% 
of  the  total  GA  fleet  but  are  involved  in  several  diverse  and  unique  flight  operations 
that  introduce  their  own  distinct  set  of  security  threats  and  vulnerabilities.  The 
diversity  of  GA  aircraft  types  and  operations  flown  suggests  that  a  one-size-fits-all 
approach  to  security  is  not  practical  -  a  tenet  that  both  the  GA  industry  and  the  TSA 
agree  on.9 

General  Aviation  Airports 

Like  GA  flight  operations  and  aircraft  types,  general  aviation  airports  also  vary 
significantly  in  their  size  and  purpose  and  range  from  unpaved  private  airstrips  with 
runways  less  than  2,000  feet  in  length  located  in  remote,  unpopulated  areas  to  busy 
general  aviation  reliever  airports  situated  in  major  metropolitan  areas  and  converted 
military  airbases  with  runways  of  sufficient  length  to  handle  the  largest  of  jets. 

In  the  United  States,  there  are  more  than  19,000  total  landing  facilities  including 
both  public-  and  private-use  facilities.  Only  about  450  of  these  airports  serve 
regularly  scheduled  commercial  passenger  flights.  The  remainder  consists  of  a  wide 
variety  of  GA  airports,  heliports,  and  seaplane  bases.  Of  these,  almost  5,000  are 
public  use,  of  which  about  3,500  have  paved  runways.  A  large  number  of  private  use 
airports  -  over  4,500  out  of  about  14,000  total  airports  -  also  have  paved  runways. 
About  3,500  public  use  GA  airports  and  another  1,000  private  use  landing  facilities 
have  lighted  runways  for  night  operations.10  The  FAA’s  National  Plan  of  Integrated 
Airport  Systems  (NPIAS)  -  a  compilation  of  those  airports  eligible  for  federal 
Airport  Improvement  Program  (AIP)  funding  because  they  are  considered  vital  to  the 
nation’s  aviation  infrastructure  -  includes  278  GA  reliever  airports  that  primarily 


7  Federal  Aviation  Administration.  FAA  Aerospace  Forecasts  -  Fiscal  Years  2005-2016. 
March  2005. 

8  Ibid. 

9  See  Report  of  the  Aviation  Security  Advisory  Committee  Working  Group  on  General 
Aviation  Airport  Security  (October  1,  2003);  and  Transportation  Security  Administration, 
Security  Guidelines  for  General  Aviation  Airports.  Information  Publication  A-001  (May 
2004). 

10  Federal  Aviation  Administration.  Administrator’s  Fact  Book  (August  2005). 
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serve  GA  operations  in  major  metropolitan  areas,  plus  slightly  more  than  2,500 
additional  GA  airports  -  mostly  located  in  rural  areas  -  that  serve  as  critical  links 
between  various  communities  and  the  national  airspace  system.  Only  these  airports 
are  specifically  eligible  for  federal  AIP  funds  to  implement  security  enhancements 
such  as  hangars  to  secure  aircraft  or  improved  perimeter  fencing. 

Airports  that  exclusively  serve  GA  vary  widely  in  terms  of  their  proximity  to 
densely  populated  areas,  their  levels  of  activity,  and  the  types  of  operations 
conducted.  To  illustrate,  consider  Peachtree  -  Dekalb  County  Airport  (PDK),  a  busy 
general  aviation  reliever  located  near  Atlanta,  Georgia.  According  to  the  FAA,  PDK 
experiences  an  average  of  639  operations  per  day,  64%  by  transient  GA  aircraft. 
According  to  a  recent  survey,  PDK  ranks  20th  among  the  busiest  GA  airports  in  the 
United  States.11  While  PDK  has  an  air  traffic  control  tower,  even  at  this  relatively 
busy  airport,  the  tower  closes  during  late  night  and  early  morning  hours.  Almost  600 
aircraft  are  based  on  the  field  including  56  jets  and  13  helicopters.  Contrast  this  with 
Red  Stewart  Airfield  (401)  in  Waynesville,  Ohio  -  a  2,400  foot  long  grass  strip 
located  roughly  midway  between  Dayton  and  Cincinnati.  The  airport  -  considered 
an  “uncontrolled  field”  because  it  has  no  operating  control  tower  -  sees  less  than  50 
operations  per  day.  The  airport  is  home  to  only  44  aircraft  -  40  small  single-engine 
airplanes,  2  ultralights,  and  2  gliders  -  that  account  for  most  (89%)  of  the  flight 
activity  at  the  airport. 

Most  security  experts  agree  that  applying  identical  or  inflexible  security 
measures  at  GA  airports  that  vary  so  widely  in  their  characteristics  is  likely  to  yield 
an  unsatisfactory  solution  that  could  either  overburden  small  airport  operators  or  fail 
to  mitigate  potential  vulnerabilities  unique  to  specific  airports  or  specific  types  of 
airports.  Therefore,  a  risk-based  strategy  implementing  security  measures  tailored 
to  the  unique  characteristics  and  vulnerabilities  of  specific  airports  is  generally 
thought  to  be  preferable  and  has  been  advocated  by  aviation  security  experts  and 
representatives  from  the  GA  industry.12 

The  Economic  Impact  of  General  Aviation 

According  to  the  FAA,  general  aviation  directly  generated  $13.7  billion  and 
178,000  jobs  in  2000  and  its  overall  economic  impact  was  $40.7  billion  (roughly 
0.4%  of  the  Gross  Domestic  Product)  and  511,000  jobs.13  The  U.S.  Government 
Accountability  Office  (GAO)  provided  a  much  higher  estimate  of  the  economic 
impact  of  GA,  reflecting  statistics  often  cited  by  the  industry,  stating  that  GA 
accounts  for  about  1.3  million  jobs  and  contributes  about  $100  billion  to  the  U.S. 


11  General  Aviation  Manufacturers  Association.  General  Aviation  Statistical  Databook 
2004  (Updated  February  14,  2005).  Washington,  DC. 

12  See  Report  of  the  Aviation  Security  Advisory  Committee  Working  Group  on  General 
Aviation  Airport  Security,  and  Transportation  Security  Administration,  Security  Guidelines 
for  General  Aviation  Airports. 


13  Federal  Aviation  Administration.  FAA  Aerospace  Forecasts,  Fiscal  Years  2005-2016. 
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economy. 14  While  these  larger  figures  probably  take  into  consideration  a  broad  reach 
of  GA’s  indirect  impact  on  travel  and  transportation-related  business,  the  general 
picture  provided  by  these  various  statistics  is  that  GA  is  a  relatively  small  but 
important  component  of  the  U.S.  economy.  As  noted  by  the  FAA,  GA  provides  “on- 
the-spot  efficient  and  direct  aviation  services  to  many  medium  and  small- sized 
communities  that  commercial  aviation  cannot  or  will  not  provide.”15  GA  also  plays 
an  increasingly  important  role  in  training  pilots  and  mechanics  to  serve  the  airline 
industry.  Additionally,  GA  operations  provide  wide-ranging  capabilities  critical  to 
our  economy  such  as  emergency  medical  services,  overnight  package  delivery  to 
small  and  mid-sized  communities,  helicopter  transport  to  support  oil  drilling  in 
offshore  and  remote  locations,  and  the  aerial  application  of  pesticides  to  support 
agriculture. 

The  potential  economic  impact  of  security  on  GA  could  be  quite  significant. 
Since  the  terrorist  attacks  of  September  11,  2001,  GA  airport  operators  and  the 
industry  have  largely  relied  on  their  own  initiatives  and  resources  to  implement 
security  enhancements.  These  efforts  have  been  somewhat  limited  because  large 
scale  security  enhancements  to  protect  GA  assets  across  the  country  are  expected  to 
be  rather  substantial.  For  example,  responding  to  criticism  over  a  perceived  lack  of 
security  at  GA  airports,  Aircraft  Owners  and  Pilots  Association  (AOPA)  president, 
Phil  Boyer,  speculated  “[w]e  might  be  talking  about  $40  billion  to  fence  every  small 
airport  in  this  country,  where  in  the  world  is  that  money  coming  from?”16  While  a 
$40  billion  estimate  may  appear  somewhat  extreme  -  the  TS  A  has  spent  slightly  less 
than  $20  billion  on  all  aviation  security  screening  and  enforcement  at  commercial 
airports  in  the  four  years  since  it  was  created  following  the  9/11  attacks  -  and 
erecting  fences  at  every  airport  in  the  country  may  not  be  the  most  appropriate  course 
of  action,  Boyer’s  concerns  highlight  the  ongoing  challenge  of  adequately  funding 
GA  security  initiatives,  balancing  these  initiatives  with  other  homeland  security 
needs,  and  doing  so  in  a  manner  that  does  not  create  an  undue  economic  burden  on 
the  GA  industry.  At  the  same  time,  the  GA  industry  has  a  vested  interest  in 
implementing  security  measures  to  adequately  secure  and  protect  airplanes  from  theft 
and  vandalism.  A  recent  article  in  a  GA  trade  publication  noted  that  while  the  intent 
of  tightening  GA  security  has  largely  been  seen  as  a  means  to  prevent  terrorism,  “...a 
more  immediate  benefit  could  be  a  stronger  bottom  line  for  GA.”17 

The  Aviation  Security  Advisory  Committee  (ASAC)  Working  Group  on 
General  Aviation  Airport  Security  -  an  industry  group  assembled  to  assist  the  TSA 
in  developing  security  guidelines  for  GA  airports  -  concluded  that  “...a  flexible, 
common- sense  approach  to  general  aviation  airport  security  is  mandatory  if  the 


14  U.S.  Government  Accountability  Office.  General  Aviation  Security:  Increased  Federal 
Oversight  is  Needed,  but  Continued  Partnership  with  the  Private  Sector  Is  Critical  to  Long- 
Term  Success.  (November,  2004)  GAO-05-144. 

15  Federal  Aviation  Administration.  FAA  Aerospace  Forecasts,  Fiscal  Years  2005-2016.  p. 

V-l. 

16  Jim  Hoffer.  “Security  Practically  Non-Existent  at  Many  Small  Airports.” 

17  Robert  Ross.  “Keeping  GA  Safe  and  Secure.”  Professional  Pilot,  September  2005,  p.  70. 
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industry  is  to  retain  its  economic  vitality  and  prosper.”18  Securing  general  aviation 
operations  without  incurring  large  costs  and  without  imposing  burdensome 
restrictions  on  legitimate  general  aviation  operators  is  likely  to  remain  a  significant 
challenge  for  policymakers. 


The  Security  Challenge 

GA  security  poses  significant  challenges  for  policymakers  and  security  experts 
because  GA  is  highly  diverse,  geographically  dispersed,  and  relatively  open 
compared  to  commercial  airports  servicing  passenger  airlines  and  other  protected 
infrastructure  such  as  nuclear  reactors  and  chemical  plants.  The  security  threat  is  not 
so  much  to  GA  assets  themselves,  but  rather,  from  terrorists  seeking  to  exploit  GA 
assets  to  attack  critical  infrastructure  or  high  profile  targets.  However,  some  GA 
assets  could  themselves  become  terrorist  targets.  For  example,  some  corporate 
aviation  operators  have  expressed  concern  that  aircraft  carrying  high  profile  business 
leaders  and  executives,  such  as  presidents  of  major  U.S.  corporations,  could  be 
targeted.  Nonetheless,  the  primary  threat  identified  regarding  GA  is  the  concern  that 
aircraft  may  be  used  by  terrorists  to  launch  an  attack  against  critical  facilities  or 
infrastructure. 

A  secondary  threat  is  that  terrorists  may  infiltrate  or  otherwise  exploit  GA  to 
gain  knowledge  and/or  access  to  the  airspace  system  in  the  United  States.  It  is  known 
that  some  of  the  9/11  hijackers  trained  in  small  GA  airplanes  in  the  United  States 
before  carrying  out  their  attack  using  commercial  jets.  Consequently,  following  9/11, 
there  was  a  specific  focus  both  from  a  law  enforcement  and  a  policy  perspective  on 
the  security  of  flight  schools  within  the  United  States.  The  Aviation  and 
Transportation  Security  Act  (ATSA;  P.L.  107-71)  originally  called  on  the 
Department  of  Justice  to  implement  a  program  to  conduct  background  checks  of  all 
alien  applicants  seeking  flight  training  in  the  United  States  in  aircraft  weighing  more 
than  12,500  pounds  and  mandated  security  training  for  flight  school  employees. 
Vision  100  (P.L.  108-176)  placed  the  responsibility  for  these  flight  school 
background  checks  in  the  hands  of  the  TSA  and  expanded  the  program  to  include  a 
notification  requirement  when  foreign  students  initiate  training  in  lighter  aircraft 
weighing  less  than  12,500  pounds.  These  measures  were  enacted  in  direct  response 
to  the  perceived  threat  that  terrorists  may  infiltrate  flight  schools  in  order  to  gain 
operating  knowledge  of  aircraft  and  the  U.S.  national  airspace  system. 

Since  September  11,  2001,  policies  toward  broader  GA  security  issues  of 
protecting  aircraft  and  airports  from  being  exploited  in  terrorist  attacks  have  focused 
on  providing  general  guidelines  and  implementing  cooperative  arrangements  between 
the  GA  industry  and  the  TSA  for  carrying  out  security  enhancements  without 
imposing  a  rigorous  statutory  or  regulatory  framework.  The  GA  industry  has  argued 
that  inflexible  statutory  or  regulatory  measures  could  impose  unnecessary  burdens 
on  certain  sectors  of  the  GA  industry  and  could  be  extremely  costly  to  carry  out 


18  Report  of  the  Aviation  Security  Advisory  Committee  Working  Group  on  General  Aviation 
Airport  Security.  October  1,  2003.  Department  of  Homeland  Security,  Transportation 
Security  Administration,  p.  3. 
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effectively.  Legislative  actions  addressing  GA  security  have  focused  primarily  on  the 
vetting  of  foreign  flight  school  applicants,  GA  pilots,  and  more  recently,  prospective 
charter  and  lease  customers.  Regulatory  actions  have  primarily  focused  on  airspace 
restrictions  and  protections,  mostly  around  the  nation’s  capital,  in  addition  to 
addressing  statutory  mandates  for  vetting  certain  individuals  with  access  to  GA 
airports  and  aircraft.  Physical  security  of  GA  airports  and  aircraft  has  largely  been 
left  to  aircraft  owners  and  pilots,  airport  operators,  and  local  authorities.  While 
aircraft  owners  and  pilots  have  generally  favored  this  approach  to  avoid  potentially 
restrictive  federal  security  regulations,  it  has  created  a  perceived  burden  on  airport 
operators  and  local  authorities  to  identify  and  address  security  needs  at  the  airport 
level.  The  TSA  has  issued  guidelines,  largely  based  on  industry  recommendations, 
but  the  federal  involvement  in  terms  of  both  regulatory  activity  and  funding  for  GA 
security  initiatives  has  been  relatively  limited.  This  approach  has  led  the  media  and 
some  policymakers  and  security  experts  to  voice  concerns  over  what  they  perceive 
to  be  persisting  vulnerabilities  at  some  GA  airports. 


Security  Vulnerabilities 

Some  media  reports  have  raised  significant  concerns  over  what  has  been 
described  as  “practically  nonexistent”  security  at  many  small  general  aviation  (GA) 
airports.19  GA  advocates  have  countered  that  small  general  aviation  aircraft  do  not 
pose  a  significant  threat  and  point  out  that  many  GA  airports  have  taken  reasonable 
steps,  largely  on  their  own  initiative,  to  enhance  security.20  However,  security 
concerns  remain  and  a  few  high-profile  incidents  pointing  to  vulnerabilities  in  GA 
security  have  attracted  considerable  attention  and  raised  concerns  among  some 
policymakers  and  security  experts. 

In  the  first  of  these  high-profile  incidents  following  the  terrorist  attacks  of 
September  11,  2001,  a  student  pilot  intentionally  crashed  a  small  single  engine 
airplane  into  a  skyscraper  in  downtown  Tampa,  Florida  on  January  5,  2002.  The 
pilot,  described  as  a  troubled  youth,  reportedly  had  expressed  support  for  Osama  bin 
Laden  and  the  9/11  terrorist  attacks,  but  acted  alone  and  had  no  known  ties  to  any 
terrorist  groups.21  More  recently,  on  July  22, 2005,  a  small  ultralight  crashed  near  the 
German  parliament  building  and  Chancellor’s  office  in  Berlin  in  what  was  described 
by  German  air  traffic  control  officials  as  a  suspected  suicide.22  The  crash  prompted 
German  officials  to  establish  a  no-fly  zone  over  central  Berlin  and  again  raised 
concerns  in  the  United  States  over  protecting  key  assets  from  possible  attacks  using 


19  See,  for  example,  Jim  Hoffer.  “Security  Practically  Nonexistent  at  Many  Small  Airports.” 
WABC  TV-New  York  Eyewitness  News,  February  5,  2004. 

20  Aircraft  Owners  and  Pilots  Association.  General  Aviation  and  Homeland  Security:  A 
Security  Brief  by  the  Aircraft  Owners  and  Pilots  Association.  Frederick,  MD  (January  23, 
2004). 

21  Vickie  Chachere.  “Police:  Student  pilot  who  crashed  Cessna  into  Florida  building 
inspired  by  bin  Laden.”  Associated  Press  Newswires,  January  7,  2002. 

22  David  McHugh.  “Small  Plane  Crashes  Near  German  Parliament.”  Associated  Press 
Newswires,  July  22,  2005. 
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GA  aircraft  as  this  incident  occurred  just  over  two  months  after  a  high-profile  breach 
of  the  protected  airspace  around  Washington,  DC,  by  an  unauthorized  single-engine 
airplane  that  prompted  evacuations  of  the  White  House  and  the  U.S .  Capitol.23  While 
these  incidents  have  received  significant  attention  given  the  focus  on  aviation 
security  following  the  attacks  of  September  11,  2001,  GA  aircraft  have  been  used 
maliciously  in  earlier  incidents  of  this  kind.  Most  notably,  in  the  early  morning  of 
September  12, 1994,  a  suicidal  individual  with  a  history  of  mental  illness,  reportedly 
despondent  over  personal  and  business  problems,  intentionally  crashed  a  stolen  small 
single-engine  airplane  on  the  south  lawn  of  the  White  House.24  While  the  small 
airplane  was  completely  destroyed  and  the  perpetrator  was  killed  in  the  crash, 
property  damage  was  minimal  and  the  incident  posed  no  threat  to  those  in  the  White 
House. 

Although  these  events  have  attracted  substantial  media  interest,  such  incidents 
are  relatively  rare.  While  they  identify  real  vulnerabilities  in  GA  security,  GA 
advocates  caution  that  they  should  be  properly  viewed  in  the  broader  context  of  risk 
assessment  which  fully  takes  into  account  the  security  threat  to  critical  infrastructure 
posed  by  these  aircraft  as  well  as  the  nature  and  scope  of  specific  vulnerabilities. 
First,  while  each  of  these  cases  highlight  the  potential  threat  of  general  aviation 
aircraft,  it  is  important  to  note  that  in  each  of  these  cases,  damage  caused  by  the 
aircraft  was  relatively  limited  and  no  injuries  or  deaths  to  persons  on  the  ground 
occurred.  Second,  while  the  incidents  in  Tampa  and  Berlin  and  the  1994  White 
House  incident  point  to  a  legitimate  concern  over  suicidal  pilots,  a  cursory  review  of 
National  Transportation  Safety  Board  (NTSB)  aviation  accident  data  revealed  that 
since  1962,  suspected  suicides  using  GA  aircraft  are  extremely  rare,  occurring  at  a 
rate  of  less  than  2  incidents  per  year.25  Perhaps  more  notably,  none  of  these  incidents 
resulted  in  any  deaths  of  persons  on  the  ground. 

Recent  high-profile  thefts  of  GA  aircraft  in  2005  have  also  raised  security 
concerns  because  they  point  to  vulnerabilities  in  GA  operations  that  could  be 
exploited  by  terrorists.  For  example,  in  an  incident  that  occurred  on  June  22,  2005, 
a  20-year  old  Connecticut  man  allegedly  stole  an  aircraft  from  a  Danbury, 
Connecticut  flight  school  and  took  two  teenage  accomplices  on  a  late-night  “drunken, 
three-hour  joyride”  before  landing  on  a  taxiway  at  the  Westchester  County,  New 
York  airport.26  More  recently,  on  October  9,  2005,  a  22-year  old  Georgia  man 
allegedly  stole  a  Cessna  Citation  VII  business  jet  from  the  St.  Augustine,  Florida 
airport  and  took  friends  -  reportedly  unaware  that  the  airplane  had  been  stolen  -  on 


23  Hugh  Williamson.  “Ban  on  Small  Aircraft  Flying  Over  Berlin.”  Financial  Times 
(London),  July  25,  2005. 

24  The  White  House  Office  of  the  Press  Secretary.  Press  Briefing  by  Ron  Noble,  Under 
Secretary  of  the  Treasury  for  Enforcement  and  Carl  Meyer,  Special  Agent,  United  States 
Secret  Service.  September  12,  1994.  Robert  Pear.  “Crash  at  the  White  House:  The  Pilot.” 
The  New  York  Times,  September  13,  1994,  p.  20. 

25  CRS  analysis  of  NTSB  Aviation  Accident  Database  and  Synopses  from  1962-2004 
(available  at  [http://www.ntsb.gov/ntsb/query.asp]). 

26  Richard  Liebson.  “1  Held  in  Drunken  Joy  Ride  in  Cessna.”  The  Journal  News  (White 
Plains,  NY),  June  23,  2005,  p.  1A. 
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a  late-night  joyride  of  more  than  300  miles,  landing  at  Gwinnett  County  (Georgia)  - 
Briscoe  Field  airport  near  Atlanta.27  While  thefts  of  jets  are  extremely  rare,  in 
another  incident  that  occurred  on  December  15,  1997,  an  individual  with  falsified 
FAA  credentials  stole  a  Lear  Jet  from  the  Fort  Lauderdale  Executive  airport  in 
Florida  and  piloted  the  airplane  to  Nicaragua  to  use  the  plane  for  charter  flight 
operations. 

Like  suspected  suicides  using  aircraft,  thefts  of  small  GA  aircraft  are  relatively 
rare  and  thefts  of  jet  aircraft  are  virtually  unheard  of.  The  AOPA  notes  that, 
historically,  only  about  a  dozen  GA  aircraft  are  stolen  each  year  and  recent  trends 
suggest  that  owners  and  operators  of  these  airplanes  are  taking  steps  to  reduce  their 
vulnerability  to  theft.29  Specifically,  the  AOPA  cites  statistics  from  the  Aviation 
Crime  Prevention  Institute,  Inc.  indicating  that  while  13  GA  aircraft  were  stolen  in 
2002,  only  6  (5  light  single-engine  aircraft  and  one  medium-sized  twin-engine 
aircraft)  were  stolen  in  2003. 30  Arguably,  these  statistics  do  not  indicate  that  GA 
aircraft  are  not  vulnerable  to  theft,  but  rather  may  simply  suggest  that  existing 
vulnerabilities  in  GA  security  are  rarely  exploited.  While  airplane  thefts  may  be  rare, 
high-profile  thefts,  like  the  cases  cited  above,  provide  some  evidence  that  individuals 
with  knowledge  of  GA  airports  and  aircraft  could  exploit  existing  security 
vulnerabilities  and  access  aircraft  relatively  easily. 


The  Terrorist  Threat 

While  none  of  the  events  discussed  above  has  been  linked  to  terrorism,  some 
limited  intelligence  information  that  has  been  made  public  suggests  a  continued 
terrorist  interest  in  using  GA  aircraft  to  carry  out  attacks  both  domestically  and 
overseas.  For  example,  a  crop  duster  pilot  in  Florida  identified  9/11  suicide  hijacker 
Mohammed  Atta  as  an  individual  who  had  approached  him  in  early  2001  inquiring 
about  the  purchase  and  operation  of  crop  duster  aircraft.31  Similarly,  U.S.  authorities 
presented  evidence  that  Zacharias  Moussaoui  -  who  was  arrested  prior  to  the  9/1 1 
attacks  after  raising  suspicions  surrounding  his  desire  to  train  in  large  aircraft 
simulators  and  pleaded  guilty  to  conspiring  with  the  9/11  hijackers  -  made  similar 
inquiries  about  starting  a  crop  dusting  company  while  living  in  Norman,  Oklahoma. 


27  Mike  Morris.  “Bufurd  Man,  22,  Accused  of  Stealing  Jet.”  The  Atlanta  Journal- 
Constitution,  October,  12,  2005. 

28  U.S.  Department  of  Justice.  Marcos  Daniel  Jimenez,  United  States  District  Attorney  for 
the  Southern  District  of  Florida.  “Defendant  Sentenced  for  Transporting  Stolen  Lear  Jet  and 
Possession  of  False  Identification  Documents.”  Press  Release,  January  5, 2005:  Miami,  FL. 

29  Aircraft  Owners  and  Pilots  Association.  General  Aviation  and  Homeland  Security. 

30  Ibid.',  Testimony  of  Mr.  Andrew  Cebula,  Senior  Vice  President,  Government  and 
Technical  Affairs,  Aircraft  Owners  and  Pilots  Association,  Before  the  Senate  Committee 
on  Commerce,  Science,  and  Transportation  Regarding  General  Aviation  Security,  June  9, 
2005. 

31  Statement  for  the  Record  of  Robert  S.  Mueller  III,  Director,  Federal  Bureau  of 
Investigation,  Before  the  Joint  Intelligence  Committee  Investigation  into  September  1 1 ,  U.S. 
Congress,  June  18,  2002 
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Evidence  was  also  presented  that  Moussaoui  was  in  possession  of  a  computer  disk 
containing  information  regarding  the  aerial  application  of  pesticides.32  This  evidence 
raised  concerns  at  the  Central  Intelligence  Agency  (CIA)  that  al  Qaeda  has 
“considered  using  aircraft  to  disseminate  [biological  warfare]  agents.”33 

The  CIA  also  suggested  that,  in  initially  planning  the  9/1 1  attacks,  one  of  Osama 
bin  Laden's  associates  proposed  that  the  World  Trade  Center  be  targeted  by  small 
aircraft  packed  with  explosives,  but  bin  Laden  himself  altered  the  plan  to  use  large 
commercial  jets  instead.34  If  true,  this  suggests  that  terrorists  engaged  in  some 
deliberative  process  of  weighing  the  pros  and  cons  of  general  aviation  as  compared 
to  commercial  airlines  in  planning  the  9/11  attacks.  While  the  terrorists  favored 
commercial  aircraft  in  carrying  out  their  attack  on  September  11,  2001,  in  the 
post-9/11  environment,  heightened  security  measures  at  commercial  airports  could 
make  GA  assets  considerably  more  attractive  to  terrorists  than  in  the  past.  While  it 
is  unlikely  that  small  GA  aircraft  packed  with  conventional  explosives  could  cause 
the  amount  of  destruction  inflicted  on  September  11,  2001,  large  jet  aircraft  in  the 
GA  fleet  or  smaller  aircraft  carrying  chemical,  biological,  radiological,  or  nuclear 
(CBRN)  weapons  may  pose  a  more  formidable  threat. 

Although  no  publically  available  intelligence  on  terrorist  operations  since 
September  11,  2001,  has  indicated  any  specific  threat  involving  GA  aircraft 
domestically,  evidence  indicates  that  al  Qaeda  has  maintained  a  continued  interest 
in  using  small  aircraft  to  attack  U.S.  interests  overseas.  Lor  example,  on  April  29, 
2003,  Pakastani  authorities  apprehended  Waleed  bin  Attash  (a.k.a.,  Khallad,  Tawfiq 
bin  Attash),  the  suspected  mastermind  of  the  U.S.S.  Cole  bombing  and  a  known 
associate  of  the  9/11  hijackers,  and  five  other  suspected  al  Qaeda  operatives  in 
Karachi,  Pakistan.  Soon  after  the  arrests,  authorities  uncovered  a  plot  to  crash  a 
small,  explosives-laden  airplane  into  the  United  States  consulate  office  in  Karachi 
illustrating  al  Qaeda’s  continued  interest  in  using  aircraft  to  attack  U.S.  assets.35  The 
DHS  subsequently  issued  a  security  advisory  indicating  that  al  Qaeda  was  planning 
to  use  GA  aircraft  to  attack  warships  in  the  Persian  Gulf  as  well  as  the  U.S.  Consulate 
in  Karachi,  Pakistan.  While  the  advisory  characterized  these  threats  as  a 
demonstrated  "fixation"  on  using  aircraft  in  attacks  against  U.S.  assets,  it  was 
strongly  criticized  by  GA  interests  as  being  overly  alarmist  and  overstating  the 
potential  threat  posed  by  small  GA  aircraft.36 


32  United  States  of  America  v.  Zacharias  Moussaoui  (Defendant).  Indictment.  In  the  U.S. 
District  Court  for  the  Eastern  District  of  Virginia,  Alexandria  Division.  December  2001 
Term. 

33  U.S.  Central  Intelligence  Agency.  Terrorist  CBRN:  Materials  and  Effects. 

34  U.S.  Central  Intelligence  Agency.  Unclassified  Version  of  Director  of  Central 
Intelligence  George  J.  Tenet's  Testimony  before  the  Joint  Inquiry  into  Terrorist  Attacks 
Against  the  United  States,  18  June  2002. 

35  Associated  Press.  “U.S.  Uncovers  Al-Qaida  Plot  in  Pakistan;  The  Terrorist  Group 
Allegedly  Planned  to  Fly  an  Airplane  into  the  American  Consulate.”  Telrgraph-Herald 
(Dubuque,  Iowa),  May  3,  2003,  p.  A7. 

36 


Ibid. 
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Risk  Factors  Associated  with  General  Aviation 

In  examining  the  security  risk  posed  by  aircraft  that  could  be  utilized  in  suicide 
attacks  or  as  launch  platforms  for  conventional  weapons,  the  threat  posed  by  general 
aviation  aircraft  is  largely  a  function  of  aircraft  weight,  payload  capacity  (including 
fuel  capacity),  and  speed.  Other  factors  would  likely  play  a  relatively  small  role  in 
the  overall  threat  posed  by  particular  aircraft.  For  example,  aircraft  agility  -  a  rough 
measure  of  its  capability  to  maneuver  and  evade  countermeasures  -  may  be 
considered  a  factor  in  the  risk  equation,  albeit  a  relatively  minor  one.  A  small  two- 
seat  sport  aircraft  might  be  quite  agile,  but  its  small  size,  relatively  slow  speed,  and 
limited  payload  capacity  may  significantly  limit  the  threat  posed  by  such  an  aircraft. 
GA  interests  point  out  that  most  GA  aircraft  are  capable  of  carrying  less  payload  than 
a  typical  light  car.37  For  example,  both  the  Cessna  172  and  Piper  Warrior  -  very 
popular  single-engine  aircraft  -  have  maximum  takeoff  weights  of  less  than  2,500 
pounds  and  useful  payloads  (including  allowances  for  fuel  and  passengers)  of  less 
than  1,000  pounds.38  By  contrast,  the  truck  bomb  used  in  the  April  19,  1995, 
Oklahoma  City  bombing  was  believed  to  have  contained  about  5,000  pounds  of 
improvised  explosives  and  the  truck  bomb  involved  in  the  February  26,  1993 
bombing  at  the  World  Trade  Center  in  New  York  City  was  believed  to  contain  a 
1,300  pound  device.  While  these  events  involved  unusually  large  explosive  devices, 
typical  light  GA  aircraft  would  only  be  able  to  carry  a  device  a  small  fraction  of  this 
size.  Thus,  at  least  with  regard  to  being  used  as  a  platform  for  conventional 
explosives,  the  threat  posed  by  light  GA  aircraft  is  relatively  small  compared  to 
trucks  which  have  significantly  larger  payload  capacities.39 

However,  as  ground  based  security  measures  such  as  setbacks,  barriers,  and 
access  controls  are  implemented  around  critical  infrastructure,  terrorists  may  view 
GA  aircraft  as  a  possible  means  to  circumvent  these  defenses.  While  many  forms  of 
ground  transportation,  especially  trucks,  can  accommodate  significantly  larger 
payloads  than  almost  all  GA  aircraft,  some  observers  fear  that  aircraft  may  be  used 
in  a  terrorist  attack  because  they  cannot  be  as  easily  thwarted  by  blockades,  barriers, 
or  other  physical  security  measures.  Nonetheless,  executing  an  attack  that  involves 
loading  a  GA  aircraft  with  a  large  quantity  of  explosives  may  be  difficult  without 
raising  some  suspicion  at  the  airport,  at  least  domestically  where  airport  operators 
and  pilots  have  been  instructed  to  be  vigilant  for  such  unusual  activities. 

While  the  threat  posed  by  light  GA  aircraft  carrying  conventional  explosives  is 
limited  by  the  size  and  speed  of  these  aircraft ,  some  experts  argue  that  small  aircraft 


37  Aircraft  Owners  and  Pilots  Association.  General  Aviation  and  Homeland  Security:  A 
Security  Brief  by  the  Aircraft  Owners  and  Pilots  Association.  (January  23,  2004,  Frederick, 
MD). 

38  Based  on  information  from  Cessna  Aircraft  Company,  Information  Manual:  Skyhawk 
Model  172P,  May  12,  1981,  and  Piper  Aircraft  Corporation,  Piper  Warrior  II  Information 
Manual,  Revised  September  12,  1990. 

39  While  weight  is  not  the  only  consideration  in  evaluating  explosive  force,  it  is  meaningful 
for  comparing  the  potential  threat  posed  by  aircraft  and  vehicles  that  differ  in  terms  of  their 
payload  capacity. 
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may  pose  a  significant  threat  if  used  as  a  platform  to  launch  a  chemical,  biological, 
radiological,  or  nuclear  (CBRN)  attack  over  a  densely  populated  area.  In  these  cases, 
payload  capacity  and  speed  may  not  be  considered  as  significant  components  of  the 
risk  equation.  Rather,  with  regard  to  the  CBRN  threat,  the  most  significant  element 
associated  with  small  GA  aircraft  appears  to  be  their  unique  capability  to  fly  at 
relatively  low  altitudes  above  densely  populated  areas  and  large  congregations  of 
people  on  the  ground.  In  fact,  the  slow  speed  of  these  smaller  aircraft  and  the  ease 
at  which  doors  and  windows  on  non-pressurized  airplanes  and  helicopters  can  be 
operated  in  flight  may  actually  pose  a  greater  threat  of  certain  types  of  attacks,  such 
as  chemical  and  biological  attacks,  as  compared  to  larger,  faster  aircraft.  Agricultural 
aircraft  used  for  spraying  crops  with  pesticides  and  fertilizers  pose  a  unique  threat  as 
a  platform  for  a  biological  or  chemical  attack  because  they  are  specifically  designed 
for  aerial  dispersal  and  could  be  exploited  by  terrorists  for  this  specific  purpose. 

However,  the  chemical  and  biological  threat  using  GA  aircraft  may  not  be  as 
ominous  as  some  fear.  First,  many  chemical  agents  must  be  released  in  rather  high 
concentrations.  Some,  such  as  cyanides,  may  only  be  effective  as  a  chemical  weapon 
if  dispensed  in  an  enclosed  area  therefore  greatly  limiting  the  threat  of  aerial 
dispersion.40  While  other  chemical  agents  -  such  as  caustic  mustard  agents  and 
military  nerve  agents  -  may  be  effective  in  open  air  settings,  the  limited  payload  of 
small  GA  aircraft  may  limit  the  scope  of  an  aerial  attack  using  such  agents.  Second, 
aerial  dispersion  of  either  chemical  or  biological  agents  over  populated  areas  or  large 
congregations  of  individuals  is  likely  to  be  easily  detected.  If  a  suspected  aerial 
dispersion  of  a  chemical  or  biological  agent  is  promptly  reported,  a  timely  public 
health  response  could  significantly  limit  the  impact  of  such  an  attack.  In  general, 
experts  believe  that  if  any  chemical  or  biological  attack  were  to  occur  -  whether 
using  a  small  airplane  or  some  other  method  to  attack  -  it  would  likely  be  on  a  small 
scale  physically,  but  may  have  a  large  psychological  impact  on  the  population.41 

More  specifically,  in  terms  of  using  small  GA  aircraft  to  carry  out  such  an 
attack,  the  greatest  threat  appears  to  be  to  large,  open-air  assemblies  such  as  major 
outdoor  sporting  events  and  concerts.  In  fact,  one  of  several  homeland  security 
planning  scenarios  -  developed  by  the  White  House  Homeland  Security  Council  in 
partnership  with  the  DHS  -  describes  the  potential  effects  of  an  adversary  using  a 
light  aircraft  to  spray  a  chemical  blister  agent  into  a  packed  college  football  stadium 
holding  100,000  people.42  The  scenario’s  predicted  impact  includes  70,000 
hospitalizations  due  to  exposure,  including  many  permanent  impairments  and  150 
deaths,  but  notes  that  expedient  decontamination  could  reduce  injuries  by  one  half. 
This  would  likely  be  a  worst  case  scenario  in  which  an  extremely  large  assembly  of 
people  could  potentially  be  victimized.  Even  in  densely  populated  areas,  this  degree 
of  impact  from  an  aerial  attack  not  specifically  targeting  a  large  outdoor  assembly  is 
unlikely  because  it  might  be  expected  that  many  individuals  would  be  indoors  or 


40  U.S.  Central  Intelligence  Agency.  Terrorist  CBRN. 

41  See  CRS  Report  RL31831,  Terrorist  Motivations  for  Chemical  and  Biological  Weapons 
Use:  Placing  the  Threat  in  Context,  by  Audrey  Kurth  Cronin. 

42  White  House  Homeland  Security  Council,  David  Howe,  Senior  Director  for  Response  and 
Planning.  Planning  Scenarios:  Executive  Summaries  (July  2004,  Version  2.0). 
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adequately  protected  by  buildings  and  other  structures.  Nonetheless,  while  such  an 
attack  may  be  limited  in  terms  of  its  physical  impact,  it  may  cause  widespread  fear 
and  panic. 

By  comparison,  the  threat  from  radiological  and  nuclear  devices  appears  to  be 
much  greater  in  terms  of  the  potential  for  mass  casualties  and  physical  destruction. 
A  small-scale  explosive  radiological  dispersal  device  -  a  so-called  “dirty-bomb”  - 
could  easily  fit  inside  a  backpack,43  and  a  pilot  carrying  such  a  device  on  to  a  small 
airplane  may  not  arouse  any  particular  suspicion  at  an  airport.  However,  the  threat 
from  such  devices  is  not  unique  to  GA  aircraft  as  these  devices  could  reach  their 
intended  target  by  other  means,  including  being  carried  in  a  small  car  or  even  being 
carried  by  a  pedestrian.  Most  experts  concede  that,  once  in  the  hands  of  terrorists, 
it  may  be  difficult  to  stop  an  attack  with  a  radiological  or  nuclear  device  because 
many  options  are  available  to  deliver  the  weapon  to  its  intended  target.  Using  GA 
aircraft  is  one  of  many  means  for  launching  such  an  attack.  However,  there  is  no 
reason  to  believe  that  GA  aircraft  are  any  more  appealing  to  terrorists  nor  any  more 
vulnerable  than  other  possible  methods  of  attack. 

Concerns  have  also  been  raised  over  the  potential  threat  that  an  aircraft  attack 
may  pose  to  a  nuclear  power  plant,  a  chemical  plant,  or  other  potentially  vulnerable 
infrastructure  where  a  terrorist  attack  could  inflict  widespread  damage  and  mass 
casualties.  A  review  of  security  measures  at  nuclear  reactors  prepared  by  the  office 
of  Representative  Markey  identified  several  perceived  vulnerabilities  at  nuclear 
reactor  sites  suggesting  that  these  facilities  may  be  vulnerable  to  9/11-style  attacks 
using  general  aviation  aircraft.  Based  on  information  provided  by  the  Nuclear 
Regulatory  Commission,  Representative  Markey’ s  office  issued  a  report  on  nuclear 
reactor  security  that  included  an  assessment  of  the  vulnerability  of  these  facilities  to 
an  attack  by  aircraft.44  The  report  noted  that  while  21  out  of  103  reactors  in  the 
United  States  are  located  within  5  miles  of  an  airport,  96%  of  U.S.  nuclear  reactors 
did  not  factor  the  impact  from  even  a  small  aircraft  into  their  design.  Four  reactors 
were  evaluated  during  their  design  to  consider  impacts  from  aircraft  weighing  up  to 
12,500  pounds  which  would  include  most  GA  aircraft  except  for  business  jets  and 
large  twin  engine  aircraft.  Three  Mile  Island  in  Pennsylvania  was  cited  as  the  only 
facility  where  portions  were  designed  to  withstand  the  impact  of  large  airliners  in 
addition  to  smaller  aircraft.  In  contrast,  the  report  noted  that  some  European 
countries,  including  Switzerland  and  Germany  in  particular,  incorporate  safety 
features  such  as  reinforced  concrete  walls  and  spatial  separation  of  critical  safety 
systems  to  withstand  the  crash  of  certain  types  of  military  and  commercial  aircraft. 

Other  examinations  of  the  potential  threat  to  nuclear  facilities  from  aircraft  have 
focused  on  perceived  vulnerabilities  of  spent-fuel  pools  used  to  cool  expended 
nuclear  fuel.  However,  power  companies  maintain  that  a  study  modeling  the  impact 


43  U.S.  Central  Intelligence  Agency.  Terrorist  CBRN. 

44  Staff  Summary  of  Responses  by  the  Nuclear  Regulatory  Commission  to  Correspondence 
from  Rep.  Edward  J.  Markey  (D-MA),  Member,  Energy  and  Commerce  Committee,  U.S. 
House  of  Representatives.  Security  Gap:  A  Hard  Look  At  the  Soft  Spots  in  Our  Civilian 
Nuclear  Reactor  Security.  March  25,  2002. 
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of  an  aircraft  crash  into  a  spent-fuel  pool  wall  concluded  that  while  such  a  scenario 
could  crush  or  crack  the  wall,  it  would  not  likely  cause  a  release  of  radiation45. 

A  report  prepared  for  the  AOPA  by  Robert  Jefferson,  a  nuclear  reactor  safety 
consultant,  concluded  that  the  threat  to  nuclear  reactors  from  small  general  aviation 
aircraft  is  “practically  non-existent”  and  “...it  is  unlikely  that  a  terrorist  would  choose 
a  light  general  aviation  vehicle  to  threaten  a  nuclear  power  plant.”46  Jefferson’s 
analysis  concluded  that  even  the  impact  of  an  airliner  like  those  used  in  the  9/11 
attacks  would,  in  all  likelihood,  be  unable  to  penetrate  the  outer  containment  vessel 
and  argued  that  the  analysis  referenced  by  Representative  Markey  significantly 
overstates  the  risk  potential  and  “...overlooks  the  fact  that  by  their  very  design, 
nuclear  power  plants  are  inherently  resistant  to  [airborne  attacks].”47  The  report  also 
concluded  that  the  proximity  of  nuclear  reactors  to  GA  airports  does  not  increase  the 
exposure  of  these  facilities  to  terrorist  threats. 

Although  the  specific  threat  posed  to  nuclear  facilities  by  GA  aircraft  remains 
a  contentious  issue,  the  FAA  has  kept  in  force  restrictions  on  circling,  loitering,  or 
otherwise  flying  in  a  suspicious  manner  around  nuclear  facilities.  Arguably,  these 
measures  would  provide  little  deterrent  against  a  well-planned  terrorist  attack. 
However,  they  highlight  the  continued  concern  over  possible  airborne  threats  to 
nuclear  facilities,  whatever  the  true  risk  may  be.  More  elaborate  measures  to  protect 
nuclear  facilities,  such  as  implementing  anti-aircraft  defense  capabilities  around 
nuclear  facilities,  are  wrought  with  operational  and  policy  complexities  including 
high  costs,  questionable  effectiveness,  and  a  potentially  high  risk  of  shooting  down 
an  errant  GA  pilot  who  meant  no  harm. 

While  light  GA  aircraft  appear  to  pose  a  relatively  limited  threat  by  themselves 
in  terms  of  physically  damaging  critical  infrastructure,  larger  GA  aircraft  pose  a 
potentially  more  formidable  threat.  Due  to  the  size  and  speed  of  some  of  these 
aircraft,  particularly  mid-sized  and  large  business  jets,  they  could  inflict  significant 
damage  on  buildings  and  critical  infrastructure  if  used  in  a  suicide  attack.  These 
aircraft  have  significantly  larger  payload  and  fuel  capacities  which  would  have  a 
direct  bearing  on  the  degree  of  physical  damage  they  could  cause  to  buildings  and 
infrastructure.  Thus,  in  terms  of  both  assessing  risk  and  identifying  options  for 
mitigating  the  security  risk  posed  by  GA,  the  distinction  between  small  GA  aircraft 
that  make  up  the  large  majority  of  the  fleet  and  larger  business  jets  has  important 
implications.  While  small  aircraft  appear  to  pose  a  greater  threat  as  possible 
platforms  for  chemical  or  biological  attacks,  large  business  jets  appear  to  pose  more 
of  a  threat  from  being  exploited  in  a  suicide  attack  scenario  similar  to  the  September 
11,  2001,  attacks  using  commercial  airliners.  Because  the  various  sectors  of  GA 
appear  to  pose  distinct  threats,  risk  mitigation  strategies  arguably  should  be  tailored 
to  some  degree  to  address  the  specific  security  threats  posed  by  different  sectors  of 


45  Gary  Stoller.  “Nuclear  Plants  near  Airports  May  Be  at  Risk.”  USA  Today,  June  10, 2003. 

46  Robert  M.  Jefferson.  Nuclear  Safety:  General  Aviation  Is  Not  a  Threat  (May  16,  2002), 
p.  4  and  p.  1.  Available  from  Aircraft  Owners  and  Pilots  Association,  Frederick,  MD. 

47  Ibid,  p.  1 . 
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the  GA  industry  as  well  as  the  specific  nature  of  potential  security  vulnerabilities  that 
also  vary  across  different  types  of  aircraft  and  flight  operations. 


Possible  Options  to  Mitigate  the  Security  Risks  of 

General  Aviation 

A  variety  of  options  exist  for  mitigating  security  risks  posed  by  GA  aircraft  and 
flight  operations,  many  of  which  have  been  implemented  or  are  currently  under 
development  or  consideration.  As  previously  discussed,  the  selection  of  mitigation 
options  may  need  to  be  tailored  to  specific  vulnerabilities  and  threats  of  different 
sectors  of  the  GA  industry  which  may  differ  significantly  in  their  degree  and  scope. 
While  a  wide  range  of  options  are  available,  many  of  the  more  extensive  and  costly 
options  for  providing  security  may  not  be  economically  feasible,  practical,  or 
necessary  at  smaller  GA  airports  away  from  major  population  centers.  Several 
available  options  center  on  traditional  security  techniques  to  improve  access  controls 
and  surveillance  around  GA  facilities  and  better  protect  aircraft  against  theft  and 
unauthorized  use.  Additional  options  include  procedures  for  vetting  individuals  with 
authorized  access  to  aircraft  and  aviation  facilities,  and  procedures  for  clearing 
passengers.  Another  possible  option  for  enhancing  GA  security  would  be  to  address 
law  enforcement  and  homeland  security  response  to  suspicious  activities  and 
improved  intelligence  tracking  of  such  incidents  to  identify  patterns  indicative  of 
possible  terrorist  activity.  Finally,  in  terms  of  adopting  a  layered  security  system  to 
augment  measures  put  in  place  at  airports,  airspace  restrictions  and  defenses  may  be 
considered  to  protect  high-profile  sites  and  critical  infrastructure  from  the  threat  of 
aerial  attacks. 

Costs,  in  terms  of  direct  implementation  and  oversight  costs  as  well  as  the 
indirect  costs  related  to  disruption  of  air  commerce  and  freedom  of  movement,  are 
likely  to  be  important  considerations  in  assessing  the  utility  and  feasibility  of 
implementing  specific  options  to  enhance  GA  security.  For  example,  implementing 
broadly  applied  security  requirements  for  all  GA  airports  may  impose  significant  cost 
challenges,  particularly  to  small,  rural  airports  where  the  need  for  such  measures  may 
be  questionable.  Also,  airspace  restrictions  tend  to  be  highly  contentious  because 
while  they  directly  impact  air  commerce  and  the  freedom  of  movement,  they  are 
viewed  by  some  experts  as  being  of  questionable  value  in  preventing  a  terrorist  attack 
unless  coupled  with  elaborate  air  defense  capabilities.  Deploying  air  defense 
capabilities  on  a  large  scale  to  protect  against  possible  aircraft  attacks  carries  a 
relatively  high  cost  and  involves  extensive  commitments  of  resources  and 
collaboration  between  the  FAA,  the  DHS  and  the  Department  of  Defense  (DoD). 
The  costs  and  benefits  associated  with  various  mitigation  options  can  be  analyzed  in 
a  risk  analysis  framework  -  examining  the  threat  and  vulnerability  of  specific  sectors 
of  the  GA  industry  -  to  better  understand  the  tradeoffs  between  various  options. 

Because  of  the  diversity  of  GA  airports,  aircraft,  and  flight  operations,  and  the 
varied  threats  and  vulnerabilities  posed  by  different  sectors  of  the  GA  industry,  a 
logical  starting  point  in  mitigating  security  risk  would  be  to  perform  systematic  risk 
analyses  or  security  risk  assessments  examining  specific  components  of  GA.  The 
FY2006  Department  of  Homeland  Security  Appropriations  Act  (P.L.  109-90) 
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contains  a  provision  requiring  the  DHS  to  examine  the  vulnerability  of  high-risk 
areas  and  facilities  to  possible  attack  from  GA  aircraft.  This  mandate  focuses  on  the 
specific  vulnerability  of  critical  infrastructure  to  attack,  which  relates  more  closely 
to  the  threat  to  critical  infrastructure  and  other  significant  sites  posed  by  GA  aircraft 
as  discussed  in  this  report.  In  this  report  vulnerability  has  referred  instead  to  the 
specific  weaknesses  in  security  measures  to  protect  GA  airports  and  aircraft  that 
could  be  exploited  to  gain  unauthorized  access  to  facilities  and  aircraft.  A 
comprehensive  risk  assessment  and  risk  mitigation  strategy  would  likely  take  into 
account  both  the  threat  and  vulnerability  associated  with  GA  operations  as  well  as  the 
potential  cost  of  consequences  associated  with  possible  terrorist  attack  scenarios. 

Security  Risk  Assessments 

Security  risk  can  be  viewed  as  a  function  of:  1)  the  threat  or  threats  posed  by  a 
specific  type  of  flight  operation  or  activity  measured  in  terms  that  attempt  to  quantify 
the  probability  of  various  terrorist  attack  scenarios;  2)  the  vulnerability  or 
susceptibility  of  existing  security  weaknesses  measured  in  probabilistic  terms 
reflecting  the  likelihood  that  they  could  be  exploited  by  terrorists;  and  3)  the  possible 
consequences  measured  in  terms  of  predicted  damage  or  associated  cost.  Using  this 
risk  analysis  framework,  the  relative  effectiveness  of  mitigation  options  can  be 
evaluated  in  terms  of  how  specific  security  enhancements  might  reduce  vulnerability 
and  how  resources  could  be  allocated  in  a  manner  to  mitigate  threats  based  on  their 
likelihood  and  their  potential  consequences.  The  anticipated  risk  reduction  can  then 
be  compared  to  expected  costs  in  an  attempt  to  determine  the  most  cost  effective 
strategies  for  enhancing  GA  security. 

For  passenger  airline  operations,  a  layered  approach  to  aviation  security  has 
been  implemented.  This  layered  system  includes  passenger  name  checks  against 
watch  lists,  passenger  and  baggage  screening,  access  controls  at  airports,  hardened 
cockpit  doors,  and  armed  air  marshals  and  pilots  on  passenger  airlines.  The  layered 
approach  has  a  unique  advantage  in  reducing  vulnerability  by  adding  additional 
safeguards  to  foil  terrorists,  thereby  greatly  reducing  the  overall  vulnerability  of  the 
entire  system.  In  probabilistic  terms,  the  vulnerability  of  the  entire  security  system 
is  the  combined  or  joint  probability  that  each  individual  layer  could  be  breached  or 
circumvented.  Thus,  while  the  threat  of  terrorism  still  exists,  most  experts  would 
agree  that,  in  the  case  of  passenger  airlines,  the  risk  of  terrorism  has  been 
significantly  mitigated  by  greatly  reducing  the  vulnerability  that  security  weaknesses 
could  be  exploited  by  terrorists  through  the  implementation  of  a  multi-layered 
security  system. 

In  the  case  of  GA,  a  systematic  examination  of  security  risk  has  not  been 
completed.  However,  many  experts  acknowledge  that  various  security  vulnerabilities 
and  threats  exist.  An  analysis  of  GA  security  by  the  International  Civil  Aviation 
Organization  (ICAO)  concluded,  “[t]he  challenge  of  designing  general  aviation 
security  measures  focuses  on  the  need  to  thoroughly  define  the  threat.  Before 
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security  standards  can  be  developed,  there  must  be  a  clear  picture  of  the  problem.”48 

One  challenge  often  cited  and  already  noted  in  this  report  is  the  diversity  of  GA 
airports.  In  many  respects,  the  characteristics  of  GA  airports  are  much  more  diverse 
than  those  of  commercial  passenger  airports.  Yet  recognition  of  this  diversity  is  not 
always  acknowledged  in  discussions  of  GA  security  risk.  In  contrast,  commercial 
passenger  airports  are  stratified  in  a  tiered  system  based  on  their  security  needs: 
commercial  airports  are  placed  into  one  of  five  categories  (Category  X,  I,  n,  IE,  IV) 
based  on  factors  such  as  the  volume  of  passengers,  the  level  of  international 
operations,  and  the  proximity  to  critical  locations  like  Washington,  DC.  A  similar 
model  could  be  adopted  to  categorize  GA  airports  based  on  their  security  risks  and 
the  particular  security  needs  of  certain  classes  of  GA  airports,  or  in  some  cases  for 
specific  operators  of  large  fleets  of  GA  aircraft.  Toward  this  goal,  the  TSA  provided 
as  part  of  its  security  guidelines  for  GA  airports  an  airport  characteristics 
measurement  tool  where  airports  are  scored  based  on  a  variety  of  factors  including 
their  proximity  to  metropolitan  areas  and  sensitive  sites;  surrounding  airspace;  the 
number  of  based  aircraft;  runway  lengths;  the  numbers  and  types  of  flight  operations; 
and  the  presence  of  maintenance,  repair,  and  overhaul  (MRO)  facilities.49  Using  this 
tool,  airports  are  scored  on  a  scale  ranging  from  0  to  64.  Based  on  the  scoring, 
airports  will  fall  within  one  of  four  bands,  and  the  TSA  has  provided  suggested 
security  enhancements  for  each  of  the  four  bands.  However,  because  use  of  this 
assessment  tool  is  voluntary,  and  because  the  process  is  relatively  generic  and  does 
not  consider  site-specific  factors,  it  provides  only  a  rudimentary  risk  assessment  tool 
and  process  for  GA  airport  operators. 

While  the  requirement  established  under  the  FY2006  Department  of  Homeland 
Security  Appropriations  Act  (P.L.  109-90)  mandates  a  broad  examination  of  the 
security  threat  posed  by  GA,  more  detailed  security  risk  assessments  can  be  done 
either  at  the  airport  level  or,  for  some  larger  operators,  such  as  fractional-ownership 
fleets,  at  the  operator  level.  Due  to  the  diversity  of  GA  airports  and  the  kinds  of 
operations  that  they  accommodate,  the  risk  picture  is  likely  to  vary  widely.  For 
example,  some  small  airports  in  mid-western  and  mountain  states  might  have  few 
security  measures  in  place  and  therefore  may  be  considered  vulnerable.  However 
because  of  their  remote  location  -  away  from  major  population  centers  -  these 
airports  may  pose  little  threat.  On  closer  examination,  it  may  be  found  that  such 
airports  may  not  be  particularly  vulnerable  to  terrorist  infiltration  based  on  several 
factors.  For  example,  a  remote  location  away  from  any  high-profile  sites  or  densely 
populated  areas  might  not  be  particularly  attractive  to  terrorists,  and  the  close-knit 
community  of  airport  users  in  small,  rural  communities  may  be  more  likely  to  spot 
outsiders  and  detect  suspicious  activity.  On  the  other  hand,  a  busy  GA  reliever 
airport  near  a  major  metropolitan  airport  may  pose  a  greater  risk.  Even  if  such  an 
airport  has  implemented  various  security  measures  to  mitigate  risk,  it  may  still  be 
regarded  as  more  vulnerable  than  a  rural  airport  because  terrorists  may  be  able  to 
more  easily  blend  in  with  large  numbers  of  individuals  accessing  the  airfield,  and 


48  Donald  Spurston.  “Security  Requirement  for  GA  Operations  Should  be  Based  on  Threat 
Assessment.”  ICAO  Journal,  Number  8,  2002,  p.  18. 

49  Transportation  Security  Administration.  Security  Guidelines  for  General  Aviation 
Airports.  Information  Publication  A-001,  May  2004. 
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while  some  access  controls  may  be  in  place,  they  may  not  be  adequate  for  preventing 
motivated  terrorists  from  circumventing  these  measures  or  exploiting  weaknesses  in 
access  controls. 

The  TS  A’s  approach  to  risk  assessment  to  meet  the  sector- specific  security  plans 
called  for  in  Homeland  Security  Presidential  Directive(HSPD)-7:  Critical 
Infrastructure  Identification,  Prioritization,  and  Protection  is  the  ongoing 
development  of  a  Vulnerability  Information  Self  Assessment  Test  (VISAT)  for  GA 
airports.  VISAT  programs  have  already  been  developed  for  other  transportation 
infrastructure  including  maritime,  rail,  bridges,  and  mass  transit,  and  others  are  under 
development  for  other  transportation  sectors  including  rail  and  trucking  HAZMATC 
The  GA  VISAT,  currently  under  development,  is  designed  to  be  a  self-guided, 
computer-based  assessment  tool  designed  to  assess  risk  and  mitigation  at  GA 
airports.  However,  this  TSA  approach  to  assessing  security  risk  at  GA  airports  has 
been  criticized  over  its  lack  of  understanding  and  differentiation  of  GA  from  the  air 
carrier  environment  and  its  extensive  reliance  on  standards  developed  for  nuclear 
power  plant  security  that  do  not  adequately  address  the  public  access  needs  of  GA 
airports.51  Critics  have  argued  that  the  TSA  should  instead,  incorporate  more  updated 
threat  and  risk  management  standards  developed  by  FEMA  that  more  fully  address 
public  access  needs.52  While  some  of  these  recommendations  may  be  incorporated 
into  the  final  assessment  tool  issued  by  the  TSA  to  assess  security  risk  at  GA  airports, 
a  comprehensive,  standardized  tool  to  perform  detailed  analyses  of  security  risks  in 
the  GA  sector  does  not  currently  exist.  Many  experts  believe  that  such  a  tool  could 
be  extremely  beneficial  for  identifying  risks  and  designing  security  programs  for 
specific  airports  or  specific  categories  of  GA  airports. 

Based  on  detailed  analyses,  cost-effective  security  programs  that  address  the 
specific  degree  and  nature  of  risk  at  specific  airports  can  be  designed  and 
implemented.  Various  combinations  of  security  measures  are  available  and  can  be 
tailored  for  airport- specific  or  operator- specific  security  plans.  These  include  various 
approaches  to:  surveillance  and  monitoring;  airport  access  controls;  and  physical 
security  measures  to  protect  aircraft.  These  specific  security  systems  implemented 
by  airports  and  operators  may  be  augmented  by  broader  initiatives  such  as  the  vetting 
of  GA  pilots  and  airport  workers  at  the  federal  level  and  establishing  specific 
procedures  and  defenses  to  protect  airspace  near  critical  locations  such  as  key  federal 
facilities  in  Washington,  DC.  In  the  following  discussion,  these  various  approaches 
and  the  challenges  associated  with  applying  them  to  GA  security  are  analyzed  in 
further  detail. 


50  Transportation  Security  Administration.  DHS-Vulner ability  Identification  Self-Assessment 
Tool  (VISAT). 

51  Robert  Olislagers.  “General  Aviation  Security:  The  Ups  &  Downs  of  Threat 
Management.”  Airport  Magazine,  May/June  2005,  pp.  59-61. 

52 


Ibid. 


CRS-21 


Surveillance  and  Monitoring 

Surveillance  and  monitoring  of  GA  operations  is  a  challenge.  Of  the  5,286 
public  use  landing  facilities  in  the  United  States,  only  about  500  have  operating 
control  towers  and  most  of  these  are  located  at  airports  with  regularly  scheduled 
commercial  service.  Only  the  busiest  airports  that  cater  exclusively  to  GA  aircraft 
have  operating  control  towers.  These  airports  usually  are  geographically  large  and 
congested  making  surveillance  for  security  purposes  from  the  tower  difficult.  What’ s 
more,  even  at  the  limited  number  of  GA  airports  with  operating  control  towers,  most 
towers  are  not  operated  on  a  continuous  basis  and  close  during  late  night  and  early 
morning  hours.  While  language  in  a  Senate-passed  amendment  to  the  FY2006  DHS 
Appropriations  bill  (see  S. Arndt.  1106  to  H.R.  2360)  would  have  required  “an 
assessment  of  whether  unmanned  air  traffic  control  towers  provide  a  security  or  alert 
weakness  to  the  security  of  general  aviation  aircraft”,  the  security  role  of  staffed 
control  towers  is  unclear.  During  operating  hours,  controllers  remain  busy 
performing  air  traffic  separation  and  control  functions,  making  it  difficult  for  them 
to  spot  unusual  activity  or  detect  unauthorized  aircraft  usage  unless  suspicions  are 
raised  by  unusual  requests,  improper  phraseology,  or  procedural  violations. 
Therefore,  the  mere  presence  of  a  operating  control  tower  appears  to  provide  little 
additional  security  to  a  GA  airfield. 

Smaller  GA  airports,  most  of  which  do  not  have  operating  control  towers,  are 
usually  not  attended  by  airport  management  or  fixed-base  operators  (FBOs)  on  the 
field  24  hours  a  day.  Depending  on  the  frequency  of  traffic,  an  airport  may  be 
attended  only  during  daylight  hours,  or  sometimes  during  limited  evening  hours. 
Aircraft  may  still  use  many  of  these  airports  during  late  night  and  early  morning 
hours  as  runway  lights  can  be  controlled  from  the  cockpit  using  onboard  radios. 
Airport  access  controls  and  surveillance  during  these  unattended  hours  presents  a 
unique  challenge  to  airport  operators.  On  the  one  hand,  accessability  is  important  to 
meet  the  needs  of  air  commerce  by  allowing  operations  such  as  late  night  arrivals  and 
departures  for  business  trips  and  overnight  cargo  delivery  to  small  communities. 
Furthermore,  maintaining  airport  accessibility  at  night  provides  a  critical  safety 
function  allowing  pilots  sufficient  alternate  landing  sites  if  required  to  deviate  for 
weather  or  mechanical  reasons.  Providing  adequate  site  security  for  GA  airports 
while  allowing  airport  access  for  these  purposes,  including  access  for  transient 
aircraft,  presents  a  daunting  challenge. 

Full  time  security  is  a  costly  option  for  many  small  airports.  Remote  sensing 
and  surveillance  using  cameras  and  motion  sensors,  for  example,  may  offer  a 
somewhat  more  cost  effective  alternative,  but  requires  close  coordination  with  local 
security  forces  and  law  enforcement  to  respond  to  suspected  threats  or  security 
breaches.  Uncertainty  and  high  false  alarm  rates  in  detection  systems  can  drive  up 
costs  associated  with  security  response  and  can  lead  to  complacency  that  may  limit 
the  effectiveness  of  these  systems.  However,  these  remotely  monitored  security 
systems  provide  an  alternative  to  security  monitoring  for  many  airport  sites  where 
full  time  on-site  security  is  cost  prohibitive.  At  least  one  vendor  provides  tailored 
security  packages,  integrating  alarms,  cameras,  entry  and  access  controls,  fencing, 
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lighting,  and  motion  and  acoustic  sensors.53  A  key  element  of  these  types  of 
integrated  security  systems  are  their  monitoring  capabilities,  including  remote 
internet-based  monitoring  of  cameras  and  other  intrusion  detection  devices,  and  the 
capability  to  tie  into  local  law  enforcement  networks  for  coordinated  response. 
However,  these  integrated  systems  can  be  quite  costly  to  install,  maintain,  and 
operate.  Consequently,  the  GA  community,  in  coordination  with  the  TSA,  has 
applied  a  long-established  method  of  providing  security  and  surveillance  in 
residential  neighborhoods  -  the  neighborhood  watch  concept  -  to  GA  airports 
throughout  the  United  States. 

Airport  Watch  Program.  To  enhance  surveillance  at  airports,  the  TSA,  in 
cooperation  with  the  AOPA  and  the  National  Response  Center,  launched  an  airport 
watch  program  at  GA  airports  in  December,  2002.54  The  airport  watch  program  is 
similar  to  a  neighborhood  watch  program  and  relies  on  the  cooperation  and 
participation  of  pilots,  airport  tenants,  and  airport  workers  to  observe  and  report 
suspicious  activity.  Educational  and  training  materials  have  been  made  available  to 
these  individuals  to  increase  their  awareness  regarding  potentially  suspicious  activity, 
and  a  hotline  -  1-866-GA-SECURE  -  has  been  set  up  to  log  reports  of  suspicious 
activity.  Under  the  program,  instructional  materials  advise  observers  to  call  local  law 
enforcement  using  911  if  they  believe  the  situation  potentially  poses  an  immediate 
threat.  The  AOPA  has  provided  funding  and  resources  since  the  program’ s  inception 
to  provide  educational  and  informational  materials  for  pilots  and  for  signage  -  similar 
to  neighborhood  watch  signs  -  at  airports.  According  to  the  AOPA,  the  organization 
has  spent  more  than  $1  million  from  its  own  funds  developing,  promoting,  and 
providing  support  for  the  Airport  Watch  Program.55  Congress  has  supported  the 
Airport  Watch  program  in  appropriations  language,  and  the  FY2006  Department  of 
Homeland  Security  Act  (P.L.  109-90;  H.Rept.  109-241  andH.Rept.  109-79)  provides 
an  additional  $275,000  for  additional  promotion  of  the  program. 

Since  its  inception,  the  Airport  Watch  program  has  been  credited  with  alerting 
authorities  to  suspicious  activities  at  GA  airports  on  several  occasions.  For  example, 
the  AOPA  cited  one  peculiar  incident  as  a  demonstration  of  the  effectiveness  of  the 
airport  watch  concept.  In  August  2004,  two  men  of  “Middle  Eastern  appearance” 
presented  themselves  at  an  airport  near  St.  Louis  offering  cash  to  charter  a  helicopter 
and  presenting  driver’s  licenses  from  two  different  states  as  identification.  The 
charter  operator  also  noted  that  the  men  were  driving  a  vehicle  registered  in  a  third 
state  and  observed  the  men  removing  “odd  shaped  luggage”  from  that  vehicle  in 
preparation  for  the  flight.  Based  on  these  observations,  the  charter  operator  stalled 
the  suspicious  individuals  and  notified  the  FBI  and  local  law  enforcement  who 
responded  and  arrested  the  two  individuals.  The  suspicious  characters  turned  out  to 
be  reporters  on  assignment  to  demonstrate  how  easily  terrorists  could  hijack  a 


53  Robert  Ross.  “Keeping  GA  Safe.” 

54  Transportation  Security  Administration.  “General  Aviation  -  Hotline.” 

55  Testimony  of  Mr.  Andrew  Cebula,  Senior  Vice  President,  Aircraft  Owners  and  Pilots 
Association.  Before  the  Senate  Committee  on  Commerce,  Science,  and  Transportation  on 
General  Aviation  Security,  June  9,  2005. 
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helicopter.56  The  AOPA  noted  several  other  successes  of  the  Airport  Watch  program 
including  the  capture  of  a  suspected  con  man  in  Kansas  who  attempted  to  rent  aircraft 
at  several  facilities,  and  several  cases  of  suspicious  inquiries  regarding  aircraft 
rentals,  charter  flights,  flight  instruction,  and  use  of  hangar  storage  space.  These 
incidents  all  resulted  in  responses  by  federal  law  enforcement  authorities,  although 
none  have  been  specifically  linked  to  terrorism.57 

Despite  the  benefits  and  successes  of  the  Airport  Watch  Program,  which  have 
been  achieved  at  a  relatively  low  cost,  there  are  several  challenges  to  implementing 
a  successful  watch  program.  A  major  limitation  of  the  Airport  Watch  Program  is  that 
it  may  be  difficult  -  especially  for  untrained  observers  -  to  distinguish  suspicious 
behavior  from  normal  activities.  Past  terrorist  attacks  have  indicated  that  terrorists 
are  likely  to  use  methods  that  avoid  arousing  suspicion.  In  essence,  terrorists  have 
in  the  past  hid  in  plain  site  and  may  be  likely  to  do  so  in  the  future. 

In  the  case  of  general  aviation,  the  all  too  obvious  example  of  a  clandestine 
rendezvous  where  cargo  is  loaded  from  a  suspicious  vehicle  on  to  a  small  aircraft  at 
a  remote  area  of  the  airport  may  likely  be  regarded  as  too  risky  by  terrorist  groups  to 
attempt.  Rather,  terrorists  may  try  to  blend  in  as  well  as  possible.  This  could  lead 
to  two  undesired  consequences:  high  false  alarm  rates  and  racial  and  ethnic  profiling 
by  well  intentioned  pilots  and  airport  tenants.  High  false  alarm  rates  could  place  a 
strain  on  local  law  enforcement,  especially  in  rural  areas  and  small  communities 
where  law  enforcement  support  is  limited.  Other  limitations  to  these  types  of 
programs  are  that  the  response  time  of  local  law  enforcement  is  often  slow,  and  local 
law  enforcement  -  especially  in  small,  rural  communities  -  may  not  be  adequately 
integrated  with  homeland  security  systems  to  receive  a  timely  notification  when  an 
incident  is  reported,  although  observers  are  specifically  instructed  to  dial  91 1  if  they 
believe  the  situation  poses  an  immediate  threat.  Another  difficulty  is  that  local  law 
enforcement  may  become  complacent  if  a  large  number  of  false  alarms  are  reported 
at  local  airports.  Despite  these  obvious  limitations,  Airport  Watch  is  regarded  by 
many  as  a  model  program  in  the  sense  that  it  raises  awareness  and  provides  a 
relatively  inexpensive  means  of  providing  surveillance.  The  program  could 
potentially  be  improved  by  providing  more  detailed  information  and  training  to 
pilots,  airport  tenants,  and  airport  workers  in  observational  techniques  -  such  as 
behavioral  pattern  recognition  -  to  improve  the  quality  of  information  provided  to  the 
Airport  Watch  hotline  or  relayed  through  other  notification  channels. 

Behavior  Pattern  Recognition.  One  challenge  in  implementing  an  Airport 
Watch  Program  is  that  it  is  highly  dependent  on  the  observations  and  reporting  of 
untrained  individuals.  This  difficulty  is  compounded  by  the  fact  that  suspicious 
terrorist  activities  may  not  appear  out  of  the  ordinary  to  the  casual  observer.  While 
convicted  terrorist  Zacharias  Mossaoui’s  peculiar  inquiries  about  flying  large  jet 
aircraft  and  his  obvious  lack  of  qualifications  to  seek  such  training  did  raise 
suspicions  at  the  flight  school  where  he  sought  advanced  jet  training,  terrorist 
behavior  patterns  are  likely  to  be  much  more  subtle.  None  of  the  9/1 1  terrorist  pilots 


56  Aircraft  Owners  and  Pilots  Association.  Proof  AOPA  Airport  Watch  Concept  Works. 
August  12,  2004.  Frederick,  MD:  AOPA. 

57  See  Testimony  of  Mr.  Andrew  Cebula. 
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nor  Mossaoui  attracted  similar  attention  during  their  initial  training  in  small  GA 
aircraft.  Qualified  pilots  seeking  to  rent  light  aircraft  also  may  attract  little  attention 
and  a  pilot  loading  a  small  single-engine  airplane  with  dangerous  chemicals  or 
biological  agents  may  look  no  different  than  a  pilot  loading  his  personal  effects  on 
board  for  a  weekend  getaway.  While  single  incidents  like  this  typically  arouse  little 
suspicion,  aggregate  behavior  that  might  appear  somewhat  odd  or  suspicious  could 
collectively  signal  possible  terrorist  or  criminal  activity. 

An  additional  downside  of  programs  like  the  Airport  Watch  Program  is  that  they 
could  result  in  unintended  racial  or  ethnic  profiling  by  well  intentioned  observers. 
For  example,  would  the  individuals  in  the  St.  Louis  incident  cited  by  AOPA  have 
raised  similar  suspicions  if  they  were  not  of  “Middle  Eastern  appearance”?  Besides 
the  potential  for  falsely  targeting  individuals  in  certain  racial  and  ethnic  groups,  there 
is  also  the  danger  that,  conversely,  untrained  observers  may  not  notice  suspicious 
behavior  patterns  exhibited  by  other  individuals.  Intelligence  sources  suspect  that  al 
Qaeda  is  seeking  to  recruit  non-Middle  Eastern  individuals  for  the  very  reason  that 
they  may  be  less  likely  to  raise  suspicions.  More  specific  guidance  and  training  to 
airport  workers,  tenants,  and  pilots  could  improve  the  effectiveness  of  the  Airport 
Watch  Program  and  other  surveillance  operations. 

A  possible  solution  to  overcome  some  of  these  limitations  involves  the 
implementation  of  behavioral  pattern  recognition  techniques.  As  described  in  a 
recent  commentary  on  GA  security,  behavioral  pattern  recognition  was  highlighted 
as  being  “...designed  to  maximize  detection  while  minimizing,  if  not  eliminating, 
issues  of  civil  liberties.”58  Behavioral  pattern  recognition  -  which  is  in  use  at 
airports  worldwide  and  has  been  highlighted  in  numerous  profiles  of  Israel’s  El  Al 
airlines’  pre-boarding  security  screening  -  examines  deviations  from  normative 
behavioral  patterns.  It  has  been  suggested  that  behavioral  pattern  recognition  could 
be  applied  in  the  GA  environment  by  providing  specific  training  to  maintenance  and 
line  workers,  for  example,  making  them  an  integral  part  of  an  airport’s  security 
network  rather  than  having  a  small  number  of  employees  responsible  for  security.59 

One  challenge  in  behavioral  pattern  recognition  is  that  single  events  may  not 
stand  out,  but  aggregate  samples  of  slightly  unusual  activity  may  provide  tell-tale 
signs  of  preparations  for  launching  a  terrorist  attack.  However,  assimilating  and 
correctly  interpreting  this  data  remains  a  significant  challenge.  For  this  reason,  a 
“reporting  tree”60  is  recommended  for  guiding  decisions  about  responding  to 
suspicious  behavioral  patterns.  The  “reporting  tree”  concept  is  integrated  into  the 
TSA’s  security  training  for  flight  schools,  which  is  a  required  security  training 
element  for  flight  school  employees  under  Title  49,  Code  of  Federal  Regulations, 
§1552.21  et  seq. ,  but  has  not  yet  been  expanded  to  other  aspects  of  GA  security.  A 
reporting  tree  might  include  notifying  a  supervisor,  such  as  a  chief  flight  instructor 
or  flight  school  manager,  about  strange  inquires  or  behaviors  by  a  student  pilot,  and 
escalating  this  information  up  the  reporting  tree  to  law  enforcement  or  federal 


58  Robert  Olislagers.  “General  Aviation  Security.”,  p.  61. 

59  Ibid. 

60  Ibid. 
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officials  only  if  the  behavior  is  repeatedly  demonstrated  and,  in  aggregate,  raises 
enough  concern  that  it  warrants  further  action.  In  this  manner,  the  Airport  Watch 
program,  in  coordination  with  specific  training  and  guidance  in  techniques  such  as 
behavioral  pattern  recognition  and  the  use  of  reporting  trees,  has  the  potential  to 
contribute  to  the  intelligence  gathering  function  at  a  relatively  low  cost  by  enlisting 
the  support  of  a  broad  segment  of  the  GA  community. 

Airport  Access  Controls 

Controlling  access  to  general  aviation  airports  is  a  significant  challenge  for 
many  reasons.  First,  as  already  discussed,  few  general  aviation  airports  are 
continuously  attended  or  monitored,  and  doing  so  is  likely  to  be  costly  and  resource 
intensive.  Second,  general  aviation  airports  support  a  wide  variety  of  operations  and 
consequently  must  provide  limited  public  access  to  support  and  sustain  these  varied 
operations  including  late  night  cargo  operations,  training  flights,  and  maintaining 
adequate  numbers  of  landing  facilities  that  are  continuously  available  for  safety  in  the 
case  of  diversions  due  to  weather  or  mechanical  difficulties. 

Providing  airport  access  for  transient  operators  also  presents  a  unique  security 
challenge  for  GA  airports,  especially  during  hours  when  the  facility  is  not  attended. 
However,  restricting  airports  from  transient  access  has  significant  consequences  both 
for  air  commerce  and  for  safety.  For  example,  restricting  access  after  hours  may 
impede  air  commerce  and  business,  especially  in  remote  areas  that  rely  significantly 
on  the  presence  of  a  GA  airport.  Professionals  who  use  GA  aircraft  to  conduct 
business  in  these  areas  may  be  reluctant  to  do  so  if  they  run  the  risk  of  being  denied 
access  to  the  airport  because  of  a  late  running  business  meeting  that  extends  beyond 
the  operating  hours  of  the  airport,  for  example.  Also,  for  safety  reasons,  sufficient 
numbers  of  GA  airports  need  to  remain  accessible,  at  least  for  landing  aircraft,  to 
provide  suitable  alternate  airports  in  case  of  emergency  or  diversion  due  to  weather. 

Supporting  airport  access  during  non-attended  hours  poses  significant  security 
challenges.  Access  control  measures  must  adequately  accommodate  transient  users 
or  the  airport  runs  the  risk  of  becoming  inaccessible  to  certain  users.  Various  options 
exist  for  providing  both  local  and  transient  operators  with  adequate  access  to  the 
flight  line.  For  example,  at  airports  implementing  access  controls  to  aircraft  storage 
and  operations  areas,  keypad  locks  can  be  installed  to  control  access  to  flight  lines. 
Codes  could  be  provided  to  transient  operators  in  case  they  need  to  access  aircraft 
after  hours  and  could  be  changed  frequently  to  prevent  unauthorized  access. 
Alternatively,  more  sophisticated  access  controls  can  be  implemented  using  key  code 
or  card  reader  systems  where  transient  operators  are  provided  with  codes  or  cards  that 
expire  and  cannot  be  used  after  a  certain  period. 

Display  of  identification  badges  in  aircraft  operations  areas  may  also  improve 
security  by  identifying  those  individuals  with  authorized  access  to  these  areas.  This 
can  alert  observers  and  security  personnel  to  possible  unauthorized  access.  TSA 
security  guidelines  for  GA  airports  suggest  that  airport  identification  credentials 
include  features  such  as  a  photograph  showing  a  full-face  image,  the  holder’s  full 
name,  the  airport  name,  employer  information,  a  unique  identification  number,  the 
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scope  of  access  and  movement  privileges  through  easily  interpretable  means  such  as 
color-coding,  and  a  clear  expiration  date.61 

Pilots,  for  whom  access  privileges  at  multiple  airports  is  needed,  require  a 
standardized  identification  that  is  easily  recognizable  at  all  airport  facilities. 
Presently,  FAA  certificates  do  not  contain  photographs  of  the  certificate  holder. 
However,  current  regulations  require  pilots  to  carry  government  issued  photo 
identification,  such  as  a  driver’s  licence,  and  present  that  identification  along  with 
their  pilot  credentials  upon  the  request  of  a  law  enforcement  officer  or  federal 
official.  ATSA  (P.L.  107-71)  directed  the  FAA  to  study  ways  to  improve  pilots 
licenses  such  as  including  photos.  While  the  FAA,  in  response,  has  taken  steps  to 
make  newly  issued  pilot  certificates  more  tamper-resistant  and  more  difficult  to 
forge,  many  pilots  still  carry  older  style  paper  certificates  that  can  be  easily  forged. 
The  Intelligence  Reform  and  Terrorism  Prevention  Act  of  2004  (P.L.  108-458,  Sec. 
4022)  requires  the  FAA  to  begin  issuing  improved  pilot  certificates  that  include  a 
photograph  of  the  holder  and  have  the  capability  to  accommodate  a  digital 
photograph,  a  biometric  identifier,  and  any  other  unique  identifiers  that  the  FAA  may 
determine  to  be  necessary.  While  specific  plans  for  issuance  of  the  new  pilot 
certificates  with  photographs  have  not  yet  been  announced  by  the  FAA,  statutory 
language  provides  for  the  use  of  designees  such  as  designated  pilot  medical 
examiners  to  issue  these  new  licenses  in  an  effort  to  “minimize  the  burdens  on 
pilots.”62  Advocates  for  GA  pilots  have  pushed  for  the  use  of  designated  aviation 
medical  examiners  for  issuance  of  the  new  certificates,  noting  that  forcing  pilots, 
particularly  pilots  in  rural  areas,  to  travel  to  an  FAA  flight  standards  district  office 
would  be,  in  their  opinion,  an  unacceptable  burden.63 

While  these  new  pilot  credentials  must  include  the  capability  to  store  biometric 
information,  the  use  of  biometrics  for  identification  purposes  and  access  controls  in 
the  GA  environment  introduces  many  complex  technical  and  policy  questions. 
Implementing  biometric  access  controls  at  GA  airports  may  be  feasible  in  some 
cases,  but  presents  significant  challenges  because  of  the  need  to  obtain  and  encode 
biometric  information  for  transient  operators  as  well  as  those  local  tenants,  pilots, 
operators,  and  airport  workers  who  are  authorized  to  have  unescorted  access  to  the 
flight  line.64  While  biometrics  have  distinct  advantages  in  terms  of  logging  and 
tracking  access  to  restricted  areas,  privacy  issues,  cost,  and  logistics  may  make  them 
difficult  to  implement  effectively  in  the  GA  airport  environment.  However, 
biometrics  may  play  a  more  significant  role  at  the  GA  operator  level  of  security 
where  they  could  be  implemented  to  control  access  to  operator  facilities  such  as 
aircraft  storage  and  maintenance  hangars.  Biometrics  may  also  be  used  on  more 
limited  sets  of  individuals  and  integrated  into  ID  card  access  systems  for  local  aircraft 


61  Transportation  Security  Administration.  Security  Guidelines  for  General  Aviation 
Airports. 

62  P.L.  108-458,  Sec.  4022. 

63  Aircraft  Owners  and  Pilots  Association.  Pilot  ID  Process  Needs  to  be  Convenient , 
Inexpensive ,  AOPA  Reminds  the  FAA.  Frederick,  MD,  July  8,  2005. 

64  In  this  context,  the  flight  line  refers  generally  to  those  areas  of  an  airport  where  aircraft 
are  accessible  including  hangars,  tie-down  areas,  and  ramps  (aprons). 
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owners,  operators,  pilots  and  airport  workers.  Doing  so  may  allow  security  efforts 
to  focus  more  directly  on  those  individuals  at  an  airport  that  pose  more  of  an 
unknown  threat,  such  as  charter  passengers  not  known  to  their  flight  crews  and  other 
airport  visitors. 

Background  Checks  and  Vetting 

Because  GA  airports  must  maintain  a  level  of  reasonable  public  accessibility  to 
facilitate  the  freedom  of  movement  by  air  and  air  commerce,  surveillance,  access 
controls,  and  physical  security  measures  to  protect  aircraft  and  facilities,  if  needed, 
must  be  designed  to  accommodate  a  diverse  set  of  legitimate  airfield  uses.  For  this 
reason,  implementing  access  controls  and  physical  security  on  par  with  commercial 
passenger  airports  is  likely  to  be  unrealistic.  However,  conducting  background 
checks  and  vetting  individuals  who  routinely  access  GA  airports  is  seen  as  a  possible 
technique  for  assessing  potential  threats  and  also  as  a  possible  means  to  focus 
security  resources  on  conducting  surveillance  and  applying  access  control  measures 
on  visitors  who  are  of  an  unknown  risk. 

Vetting  of  transportation  workers  and  others  who  routinely  access  transportation 
facilities  has  been  a  cornerstone  of  several  statutorily  mandated  projects  related  to 
transportation  security.  For  example,  the  TSA  is  required  to  conduct  background 
checks  of  workers  at  commercial  passenger  airports,  and  the  TSA  has  several 
ongoing  projects,  such  as  the  Transportation  Worker  Identification  Credential 
(TWIC)  Program  and  various  airport  access  control  pilot  studies,  that  are  attempting 
to  integrate  background  checks  and  vetting  with  the  use  of  biometric  access 
credentials .  While  it  may  be  some  time  before  these  programs  reach  maturity  and  can 
be  considered  for  application  in  the  GA  environment,  there  are  already  several 
statutory  requirements  for  vetting  GA  pilots,  pilot  applicants,  and  more  recently, 
prospective  aircraft  charter  and  lease  customers. 

The  most  widely  known  of  these  GA  programs  is  the  TSA’ s  alien  flight  training 
rule  (Title  49,  U.S.C.  §44939;  Title  49  Code  of  Federal  Regulation,  Part  1552), 
which  requires  the  TSA  to  conduct  background  investigations  of  non-U. S.  applicants 
seeking  flight  training  in  the  United  States  for  aircraft  weighing  more  than  12,500 
pounds  and  requires  flight  schools  or  flight  instructors  to  notify  the  TSA  whenever 
a  non-U. S .  applicant  wishes  to  initiate  flight  training  in  smaller  aircraft  weighing  less 
than  12,500  pounds.  In  response  to  law  enforcement  and  intelligence  information 
revealing  that  the  9/1 1  hijackers  and  accomplice  Zacharias  Moussaoui  received  flight 
training  in  the  United  States  and  amid  concerns  that  foreign  terrorists  could  further 
infiltrate  flight  schools  in  the  United  States,  the  Aviation  and  Transportation  Security 
Act  (ATSA,  P.L.  107-71)  initially  placed  the  Department  of  Justice  in  charge  of 
conducting  fingerprint-based  record  checks  for  alien  flight  school  applicants  seeking 
training  to  fly  aircraft  weighing  more  than  12,500  pounds.  Under  Vision  100  (P.L. 
108-176),  this  responsibility  was  moved  to  the  TSA,  the  process  was  streamlined  to 
limit  the  impact  of  the  process  on  legitimate  flight  training  activities,  and  reporting 
requirements  were  expanded  to  include  a  notification  requirement  whenever  foreign 
flight  school  applicants  initiate  flight  training  in  the  United  States  in  smaller  aircraft 
weighing  less  than  12,500  pounds. 
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A  lesser  known  component  of  TSA’s  efforts  to  vet  pilots  (whether  they  be  GA 
pilots,  charter  pilots,  or  airline  pilots),  aircraft  mechanics,  and  dispatchers  is  the  use 
of  threat  assessments  to  screen  holders  of  and  applicants  for  FAA  certificates,  ratings, 
or  authorizations.  Rules  pertaining  to  the  security  threat  assessments  for  FAA 
certificate  holders  and  applicants  were  promulgated  on  January  24,  2003.65  Under 
these  rules,  the  TS  A  notifies  the  FAA  whenever  a  FAA  certificate  holder  or  applicant 
is  determined  to  present  a  security  threat.  The  FAA,  in  turn,  will  deny,  suspend,  or 
revoke  the  individual’s  FAA  certificate  as  appropriate.  While  parallel  rules  were 
initially  issued  to  carry  out  security  threat  assessments  for  both  alien  applicants  and 
citizen  applicants,  the  rule  pertaining  to  U.S .  citizens  was  criticized  because  it  lacked 
adequate  safeguards  for  redress  and  remedy  if  FAA  certificate  actions  were  taken  in 
response  to  what  the  TSA  determined  to  be  a  security  threat.  Critics  argued  that  the 
rule  gave  the  TSA  significant  power  over  the  issuance  of  pilot  certificates  and  other 
aviation  credentials  without  any  oversight  or  redress  for  the  TSA  to  demonstrate  the 
specific  evidence  or  basis  for  its  decision  to  identify  a  certificate  holder  or  applicant 
as  a  security  threat.66  In  response  to  concerns  raised  regarding  the  TSA’ s  power  over 
security-related  certificate  actions  and  the  lack  of  an  adequate  redress  process,  Vision 
100  (P.L.  108-176,  Sec. 601)  mandated  the  TSA  to  establish  a  redress  and  remedy 
process  entitling  U.S.  citizens  subject  to  certificate  action  on  the  basis  of  a  security 
threat  assessment  to  a  formal  redress  hearing  before  an  administrative  law  judge  and 
an  appeals  process  before  a  panel  convened  by  the  Transportation  Security  Oversight 
Board.  The  TSA  has  not  yet  issued  revised  rulemaking  to  conform  with  the  statutory 
requirements  set  forth  in  Vision  100,  and  therefore,  existing  regulations  to  enforce 
FAA  certificate  actions  on  the  basis  of  security  threat  assessments  no  longer  apply 
to  U.S.  citizens.67  However,  security  threat  assessments  for  alien  FAA  certificate 
holders  and  applicants  remains  unchanged. 

Although  security  threat  assessments  for  citizen  pilots,  mechanics  and  other 
FAA  certificate  holders  and  applicants  has  been  suspended  until  the  TSA  develops 
a  process  and  issues  rulemaking  to  conform  with  statutory  requirements  for  redress 
and  remedy,  regulations  still  require  fingerprint-based  criminal  history  records  checks 
for  charter  pilots  who  fly  aircraft  weighing  more  than  12,500  pounds.68  However, 
other  GA  pilots  -  who  make  up  the  majority  of  the  more  than  600,000  active  pilots 
in  the  United  States  -  are  not  required  to  submit  to  any  formal  background  screening 
or  checks.  Some  critics  of  background  checks  and  vetting  maintain  that  they  are 
costly  and  an  unnecessary  intrusion  into  the  privacy  of  citizens.  On  a  pragmatic 
level,  some  question  whether  background  checks  for  GA  are  needed  at  all, 
particularly  at  small,  rural  airports  where  pilots,  ramp  workers,  and  others  who 


65  Transportation  Security  Administration.  “Threat  Assessment  Regarding  Citizens  of  the 
United  States  and  Alien  Holders  Who  Hold  or  Apply  for  FAA  Certificates;  Final  Rules.  ” 
Federal  Register,  65(16),  pp.  3756-3769  (January  24,  2003). 

66  See,  e.g.,  Llewellyn  King.  “Adm.  Loy,  You  Know  Better:  Rescind  This  Rule.”  White 
House  Weekly,  24(10),  March  11,  2003,  1-2. 

67  Transportation  Security  Administration.  Memorandum  to  the  Dockets  from  Pamela 
Hamilton,  Director  of  Aviation  Initiatives  Regarding  TSA  Rulemaking  Docket  No.  TSA- 
2002-13732  and  TSA  Rulemaking  Docket  No.  TSA-2002-13733.  March  16,2004. 

68  Title  14  CFR  §1544.101  and  §1544.230. 
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frequent  the  airport  are  largely  known  to  each  other.  Nevertheless,  background 
checks  and  other  vetting  activities  have  been  looked  upon  favorably  by  policymakers 
as  a  core  component  of  a  layered  security  system  and  could  be  further  expanded  in 
their  application  to  GA  operators. 

One  area  where  background  checks  and  security  threat  assessments  is  being 
incorporated  into  GA  operations  is  for  the  vetting  of  prospective  charter  and  lease 
customers.  Under  statutory  provisions  set  forth  in  the  Intelligence  Reform  and 
Terrorism  Prevention  Act  of  2004  (P.L.  108-458,  Sec.  4012),  the  TSA  is  charged 
with  the  task  of  setting  up  a  mechanism  for  charter  and  aircraft  lease  operators  to 
voluntarily  submit  the  names  of  prospective  clients  seeking  access  to  aircraft 
weighing  more  than  12,500  pounds  for  screening  against  the  consolidated  terrorist 
watch  list.  Aircraft  operators  may  deny  individuals  access  to  aircraft  if  their  name 
is  found  to  match  watch  list  records.  While  the  legislative  language  limited  the 
applicability  of  this  vetting  procedure  to  aircraft  weighing  more  than  12,500  pounds, 
the  feasibility  of  extending  this  capability  to  charters  and  leases  of  smaller  aircraft, 
based  on  the  initial  experience  with  larger  aircraft,  was  debated  during  consideration 
of  this  legislation.  While  terrorist  database  screening  of  prospective  charter  and 
lease  customers  as  legislated  is  voluntary,  policymakers  may  also  consider  whether 
mandatory  screening  of  aircraft  charter  and  lease  customers  is  warranted.  However, 
because  the  capability  to  screen  names  against  terrorist  watch  list  information  is  tied 
to  the  functionality  of  the  controversial  Secure  Flight  program  for  prescreening 
airline  passengers,  implementation  of  a  charter  and  lease  customer  prescreening 
mechanism  -  which  is  currently  not  operational  -  may  be  further  delayed  by  ongoing 
difficulties  in  meeting  congressionally  mandated  safeguards  for  data  and  privacy 
protections  and  redress  and  remedy  for  aggrieved  individuals  who  are  erroneously 
identified  as  suspected  or  known  terrorists.69  Presently,  language  in  the  FY2006 
Department  of  Homeland  Security  Appropriations  Act  (P.L.  109-90)  prohibits  full- 
scale  deployment  of  the  Secure  Flight  system  until  the  GAO  certifies  that  these 
lingering  concerns  are  adequately  addressed. 

Besides  prospective  charter  and  lease  customers,  the  screening  of  prospective 
aircraft  purchasers  can  serve  as  an  important  deterrent  to  prevent  terrorists  or 
organizations  that  support  terrorism  from  acquiring  aircraft  that  could  be  used  in  a 
terrorist  attack.  Under  Department  of  the  Treasury  regulations,  promulgated  to  meet 
requirements  of  the  USA  PATRIOT  Act  (P.L.  107-56),  aircraft  sales  must  comply 
with  various  information  sharing,  reporting,  and  records  keeping  requirements  aimed 
at  identifying  suspicious  transactions  and  preventing  money  laundering.70  However, 
because  many  other  large-scale  financial  transactions  such  as  the  sale  of  houses, 
boats,  and  cars  must  be  similarly  reported,  the  volume  of  transactions  may  make  it 
difficult  to  quickly  identify  suspicious  aircraft  transactions.  The  main  intent  of  these 
regulations  is  to  spot  potential  attempts  to  launder  illegal  funds  in  support  of  terrorist 
or  criminal  activities,  and  therefore  the  regulations  are  not  specifically  designed  to 
vet  purchasers  of  GA  aircraft  against  terrorist  watch  lists.  The  capability  to  detect 


69  See  CRS  Report  RL32802,  Homeland  Security:  Air  Passenger  Prescreening  and 
Counterterrorism ,  by  Bart  Elias,  William  Krouse,  and  Ed  Rappaport. 

70  See  Title  31  Code  of  Federal  Regulations,  Part  103. 
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aircraft  sales  to  suspected  terrorists  or  their  associates  and  vet  aircraft  purchasers 
against  terrorist  watch  lists  under  these  reporting  requirements  remains  unclear. 

Physical  Security  Measures  for  Airports 

Other  than  surveillance,  access  controls,  and  background  checks,  there  are  a 
variety  of  other  options  for  enhancing  the  general  physical  security  of  airport 
facilities.  One  of  the  most  obvious  of  these  measures  is  erecting  physical  barriers, 
such  as  chain-link  perimeter  fencing,  around  security  sensitive  locations  on  the 
airfield.  However,  the  TSA  cautions  that  while  physical  barriers  such  as  fencing, 
walls,  electronic  boundaries,  and  even  natural  barriers  can  protect  airport  areas  from 
unauthorized  access,  these  methods  by  themselves  will  not  prevent  determined 
intruders  from  gaining  access.  The  TSA  further  notes  that  excessive  spending  on 
extensive  perimeter  enhancements  may  actually  be  detrimental  to  an  airport’ s  overall 
security  posture  to  the  extent  that  these  efforts  take  away  from  opportunities  to 
improve  upon  other  aspects  of  security.71  Besides  fencing,  protective  lighting  can 
often  serve  as  an  effective  deterrent  against  theft,  vandalism,  unauthorized  access, 
and  other  illegal  activity  at  night.72 

While  various  combinations  of  physical  barriers  and  lighting  may  deter 
unauthorized  access  at  airports,  the  TSA  notes  that  storing  aircraft  in  hangars 
provides  one  of  the  most  effective  method  of  securing  GA  aircraft.73  However,  at 
many  GA  airports,  hangar  space  is  in  short  supply  and  the  demand  for  hangars  make 
them  very  costly,  especially  for  some  small,  privately  owned  aircraft.  Language  in 
the  Century  of  Aviation  Reauthorization  Act  -  Vision  100  (P.L.  108-176,  Sec.  149) 
provides  greater  flexibility  in  the  allocation  of  federal  Airport  Improvement  Program 
(AIP)  funds  for  the  construction  of  hangars  at  GA  airports.  Also,  to  foster  private 
investment  in  hangar  construction,  additional  language  in  Vision  100  (P.L.  108-176, 
Sec.  165)  provides  assurances  for  long-term  lease  agreements  between  tenant  aircraft 
owners  who  build  hangars  using  their  own  funds  and  airport  operators. 

Physical  Security  Measures  for  Aircraft 

While  surveillance,  access  controls,  and  physical  security  measures  at  airports 
can  provide  effective  deterrents,  these  measures  may  be  costly  and  challenging  to 
implement  at  many  GA  airports,  especially  smaller  airports.  Measures  to  physically 
secure  aircraft  can  be  viewed  as  either  an  additional  layer  of  security  to  prevent  theft 
and  unauthorized  access  to  aircraft  at  airports  with  extensive  surveillance  and  access 
controls  or  as  a  primary  means  of  security  at  some  airports  with  more  limited  security 
capabilities. 

Physical  security  measures  for  aircraft  may  include  cabin  and  ignition  locks  that 
may  already  exist  for  certain  aircraft  as  well  as  supplemental  immobilizing  devices 


71  Transportation  Security  Administration.  Security  Guidelines  for  General  Aviation 
Airports. 

72  Ibid. 

73  Ibid. 
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such  as  propeller,  throttle,  control  surface,  and  tie-down  locks.  The  TSA’s  Security 
Guidelines  for  General  Aviation  Airports  recommends  storing  aircraft  in  locked 
hangars,  consistent  use  of  aircraft  door  locks,  using  keyed  ignitions  when  appropriate, 
and  not  leaving  keys  in  aircraft  as  some  basic  steps  to  secure  GA  aircraft.  The 
guidelines  also  recommend  using  an  auxiliary  lock  such  as  commercially  available 
propeller,  throttle,  or  tie  down  locks  to  further  protect  GA  aircraft.  The  TSA  suggests 
that  “[p]ilots  should  employ  multiple  methods  of  securing  their  aircraft  to  make  it  as 
difficult  as  possible  for  an  unauthorized  person  to  gain  access  to  it.”  However,  it  is 
apparent  that  this  common  sense  advice  is  not  always  heeded.  In  the  October  2005, 
theft  of  a  Cessna  Citation  VII  business  jet,  it  was  reported  that  the  aircraft  -  which 
does  not  need  a  key  to  start  -  was  left  unlocked.74 

While  building  or  renting  secured  hangar  space  may  be  cost  prohibitive  to  many 
light  aircraft  owners,  locks  and  other  security  devices  may  provide  a  common  sense, 
cost  effective  means  to  reduce  the  vulnerability  of  GA  aircraft  to  theft.  Given  that 
aircraft  are  high  value  assets,  locks  may  offer  a  relatively  low-cost  means  to  reduce 
vulnerability.  Purchasing  and  installing  secondary  locks  could  benefit  aircraft  owners 
and  operators  by  providing  added  protection  against  theft  and  unauthorized  access. 

In  the  absence  of  explicit  federal  standards  or  requirements,  some  states  have 
taken  initiatives  to  require  specific  actions  for  securing  GA  aircraft.  New  Jersey,  for 
example,  has  implemented  a  state-wide  “two-lock  rule”  requiring  any  aircraft  parked 
or  stored  at  a  GA  facility  within  the  state  for  more  than  24  hours  to  either  secure  the 
aircraft  with  two  distinct  locking  devices  or  disable  the  aircraft  in  a  manner  to 
prevent  theft  or  illegal  use.75  The  Strengthen  Aviation  Security  Act  (H.R.  2649) 
would  require  airport  operators  to  ensure  that  “...all  general  aviation  aircraft,  while 
parked  at  such  airports,  are  secured  by  a  visible  immobilizing  device  (such  as  a  prop 
lock).”  Propeller  locks  and  throttle  locks  may  provide  relative  low  cost,  relatively 
effective  deterrents  to  unauthorized  use  and  theft  of  aircraft. 

Securing  Agricultural  Aviation  Operations 

The  specific  intelligence  and  law  enforcement  evidence  pointing  to  al  Qaeda’s 
interest  in  crop  dusting  aircraft  in  the  months  leading  up  to  9/1 1  suggests  that  the 
agricultural  sector  of  general  aviation  should  be  particularly  alert  to  suspicious 
activities.  Because  agricultural  aviation  operations  largely  take  place  in  rural 
environments,  away  from  highly  populated  areas,  increased  awareness  of  this  threat 
coupled  with  operators  increasing  their  vigilance  and  taking  steps  to  secure  their 
aircraft  may  serve  as  an  adequate  deterrent.  However,  the  unique  capabilities  of 
aircraft,  both  airplanes  and  helicopters,  used  in  aerial  application  make  them 
specifically  attractive  to  terrorists.  For  this  reason,  the  TSA  recommended  to 
operators  of  agricultural  aircraft  that  they  use  multiple  security  devices  -  such  as 
throttle  and  control  locks,  propeller  locks,  and  hidden  ignition  switches  -  to  secure 
aircraft,  store  aircraft  in  hangars  with  electronic  security  systems  and  steel  doors,  and 


74  Mike  Morris.  “Buford  Man,  22,  Accused  of  Stealing  Jet.” 

75  U.S.  Government  Accountability  Office.  General  Aviation  Security:  Increased  Federal 
Oversight  Is  Needed,  but  Continued  Partnership  with  the  Private  Sector  Is  Critical  to  Long- 
Term  Success.  GAO-05-144,  November  2004. 
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when  hangars  are  not  available,  park  heavy  equipment  in  a  manner  to  prevent  the 
movement  of  aircraft.76  The  National  Agricultural  Aviation  Association  has  provided 
additional  guidance  to  operators  of  agricultural  aircraft  advising  them  to:  secure 
pesticide  storage  areas;  implement  procedures  for  the  shipping  and  receiving  of 
chemicals;  secure  facilities  and  limit  access;  post  security  signs;  improve  lighting  of 
storage  areas;  secure  fences  and  gates;  conduct  security  inspections  to  check  for  signs 
of  intrusion  or  tampering;  maintain  logs  to  track  visitor  access  to  facilities ;  coordinate 
with  local  law  enforcement  and  fire  departments;  and  develop  site  security  plans  as 
required  to  comply  with  HAZMAT  regulations.77 

Flight  School  Security 

Besides  agricultural  aircraft  operations,  another  sector  of  GA  flying  that  has 
raised  security  concerns  has  been  flight  schools.  Flight  schools  have  been 
spotlighted,  in  large  part,  because  of  intense  media  coverage  of  the  apparent  relative 
ease  that  some  of  the  9/1 1  hijackers  were  able  to  obtain  flight  training  in  the  United 
States,  and  the  reported  lack  of  safeguards  to  prevent  incidents  like  the  intentional 
crash  of  a  small  single-engine  airplane  into  a  downtown  Tampa,  Florida  building 
piloted  by  a  student  pilot  who  stole  the  aircraft  while  conducting  an  unsupervised 
pre-flight  inspection.78 

To  address  lingering  concerns  over  flight  school  security,  Vision  100  (P.L.  108- 
176)  requires  specific  flight  school  security  awareness  training  for  all  flight  school 
employees.  To  meet  this  statutory  requirement,  the  TSA  has  developed  a 
standardized  computer-based  flight  school  security  awareness  training  program, 
although  flight  schools  have  the  option  of  developing  their  own  security  training 
program  that  must  obtain  TSA  approval.  New  hires  must  receive  initial  security 
awareness  training  within  60  days  of  employment,  and  employees  must  complete 
annual  recurrent  training  in  security  awareness.  The  training  indoctrinates  flight 
school  employees  on  fundamentals  of  security  awareness,  security  practices,  and 
appropriate  responses  to  suspicious  events.  In  addition  to  the  statutory  requirement 
for  security  awareness  training,  the  TSA  has  issued  several  recommendations  for 
flight  schools  in  its  security  guidelines  for  GA  airports.79  These  recommendations 
largely  focus  on  increasing  surveillance  and  supervision  of  students  and  renter  pilots 
and  better  controlling  access  to  aircraft  and  aircraft  keys.  Other  steps  that  may  be 
taken  by  flight  schools  to  improve  security  include  background  checks  of  prospective 
employees,  particularly  prospective  flight  instructors  and  maintenance  personnel; 
establishment  of  formal  written  security  procedures  for  employees  and  customers; 


76  Transportation  Security  Administration.  Security  Guidelines  for  General  Aviation 
Airports. 

11  Regulatory  Consultants,  Inc.  “Secure  Your  Operation  Today.”  Agricultural  Aviation, 
July/August  2005,  17-18. 

78  Jean  Heller  and  Alicia  Caldwell.  “Flight  Schools:  Breach  of  Trust  Difficult  to  Prevent.” 
St.  Petersburg  Times,  January  8,  2002. 
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display  of  identification  by  employees;  and  various  access  controls  and  surveillance 
measures  for  the  flight  line. 

Security  Best  Practices  for  Business  and  Charter  Aviation 

In  addition  to  agricultural  aviation  and  flight  schools,  another  sector  of  GA  with 
unique  security  needs  is  business  aviation.  Larger,  faster  business  jets  introduce 
unique  security  concerns  because  of  their  size  and  speed  as  well  as  their  relatively 
high  value  and,  in  some  instances,  the  prominence  of  passengers  carried  on  board 
these  aircraft.  While  business  jets  make  up  a  relatively  small  percentage  of  general 
aviation  aircraft,  their  larger  size,  heavier  payload,  and  faster  speed  introduce  unique 
risks.  Chartered  business  jets  and  turboprops  also  pose  a  unique  risk  because,  unlike 
corporate  or  privately  owned  aircraft,  flight  crews  often  do  not  know  their 
passengers. 

In  coordination  with  the  TSA,  the  National  Business  Aviation  Association  has 
implemented  a  program  promoting  aviation  security  best  practices  among  business 
aircraft  operators.80  The  program  focuses  on  various  facets  of  operator  security 
including  identifying  security  roles  within  an  operator’s  organization;  providing 
security  training  to  flight  department  personnel;  establishing  sound  physical  security 
measures  to  control  access  to  facilities  and  aircraft;  issuing  photo  IDs  for  crew 
members;  conducting  pre-flight  security  inspections  of  aircraft;  matching  baggage  to 
passengers;  maintaining  positive  control  of  baggage;  and  developing  and  keeping  up 
to  date  site  specific  security  and  emergency  response  plans. 

The  TSA  Access  Certificate  Program.  Based  in  part  on  the  NBAA’s 
initiatives  regarding  aviation  security  best  practices,  the  TSA  initiated  a  pilot 
program  for  implementing  security  protocols  for  business  aircraft  operators  in  the 
spring  of  2003.  The  program,  dubbed  TSAAC  for  TSA  Access  Certificate,  is 
currently  being  implemented  on  a  trial,  proof-of-concept  basis  at  select  airports  on 
the  east  coast.  Corporate  aircraft  operators  that  implement  TSA-approved  security 
programs  under  TSAAC  are  currently  granted  unimpeded  access  to  international 
airspace,  whereas  other  operators  must  currently  enter  and  depart  U.S.  airspace 
through  one  of  eight  designated  "portal"  countries.81  The  TSAAC  program  was 
initially  offered  as  a  pilot  program  to  operators  based  at  Teterboro  Airport  (TEB)  in 
New  Jersey.  The  program  has  since  been  expanded  to  include  operators  at 
Westchester  County  Airport  (HPN)  in  New  York,  and  Morristown  Airport  (MMU) 
in  New  Jersey.  While  the  specifics  of  the  TSAAC  program  are  regarded  as  security 
sensitive  information,  the  program  generally  requires  operators  to  implement  security 
procedures  similar  to  the  operational  security  measures  required  for  charter  aircraft 
operators  who  fly  aircraft  weighing  more  than  12,500  pounds.  Elements  of  the 
program  include  various  aspects  of  physical  security  measures  for  aircraft,  vetting  of 
customers  and  other  visitors,  control  of  passengers  and  baggage,  access  controls  for 
the  flight  line  and  aircraft  operations  areas,  and  the  utilization  of  threat  intelligence. 


80  National  Business  Aviation  Association.  NBAA  Best  Practices  for  Business  Aviation 
Security.  Washington,  DC:  National  Business  Aviation  Association,  Inc. 

81  David  Esler.  “TSAAC:  Business  Aviation’s  New  Ticket  to  Enter?”  Business  & 
Commercial  Aviation,  May  2003,  pp.  200-210. 
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The  TSAAC  is  regarded  by  many  in  the  industry  as  being  a  means  for  business 
aircraft  operators  to  gain  "...equal  access  to  airspace  and  airports  as  currently  given 
to  scheduled  air  carriers."82  This  may  include  access  to  various  flight  restricted  areas 
throughout  the  United  States.  While  the  TSAAC  has  been  hailed  by  the  business 
aircraft  industry  as  a  potential  model  for  broader  security  initiatives  covering  the 
business  aircraft  sector  of  GA,  the  program  has  been  slow  to  evolve  and  is  still 
limited  in  its  scope  of  applicability.  While  it  was  announced  on  December  30,  2004 
that  the  TSAAC  program  would  be  further  expanded  to  additional  airports83, 
progress  to  evaluate  and  identify  additional  benefits  of  the  program  have  slowed. 
Report  language  submitted  by  the  House  Committee  on  Appropriations  (H.Rept.  109- 
241;  P.L.  109-90)  signaled  strong  support  for  the  TSAAC  program,  encouraging  the 
TSA  to  move  forward  with  the  program  during  FY2006. 

Access  to  Ronald  Reagan  Washington  National  Airport.  TSAAC  has 
been  regarded  by  many  in  the  business  aviation  community  as  a  model  for  granting 
business  aircraft  operators  access  to  restricted  airspace.  Toward  that  objective,  the 
TSAAC  served  as  an  important  starting  point  for  implementing  regulations  allowing 
GA  flights  to  resume  at  the  Ronald  Reagan  Washington  National  Airport  (DCA)  as 
mandated  under  Vision  100(P.L.  108-176).  Because  DCA  is  in  such  close  proximity 
to  Washington,  DC,  it  had  generally  been  off  limits  to  GA  operators  since  the 
terrorist  attacks  of  September  11,  2001.  However,  on  August  18,  2005,  DCA 
reopened  to  GA  operators  on  a  very  limited  basis  under  an  interim  final  rule  detailing 
extensive  security  requirements  for  GA  operators  to  gain  access  to  the  airport.84  In 
addition  to  adhering  to  security  protocols  similar  to  those  outlined  in  the  TSAAC 
program,  operators  wishing  to  fly  to  and  from  DCA  must:  have  their  flight  crews 
cleared  by  background  checks;  submit  passenger  and  crew  member  names  for  vetting 
against  terrorist  watch  lists;  submit  to  physical  screening  of  passengers,  crew 
members,  and  baggage;  transition  into  DCA  from  one  of  12  designated  gateway 
airports;  and  post  designated  armed  security  officers  on  each  flight  to  and  from  DCA. 
Operators  must  reimburse  the  TSA  for  the  direct  costs  associated  with  these  security 
measures  which  in  effect  makes  access  to  DCA  cost  prohibitive  for  most  GA 
operators.  As  currently  implemented,  the  security  provisions  for  access  to  DCA  are 
designed  primarily  to  accommodate  larger  charter  operators  and  high-end  corporate 
aircraft.  The  program  is  not  currently  available  to  privately-owned  aircraft,  but  the 
TSA  indicated  that  the  program  may  be  expanded  in  about  one  year  based  on  the 
initial  experience  with  charter  and  corporate  operators.85 


82  National  Business  Aviation  Association.  TSA  Access  Certificate  (TSAAC)  -  Updated 
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84  Transportation  Security  Administration.  Ronald  Reagan  Washington  National  Airport: 
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70(137),  41586-41603  (July  19,  2005). 
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Security  Measures  for  Charter  Operations.  While  corporate  and 
privately  owned  aircraft  primarily  deal  with  passengers  known  to  the  pilots  and 
operators,  passenger  charter  aircraft  present  unique  security  challenges  because 
customers  are  sometimes  unknown  or  unfamiliar.  Charter  aircraft  weighing  more 
than  12,500  pounds  maximum  takeoff  weight  must  adhere  to  specific  security 
regulations  referred  to  as  the  twelve-five  security  program  in  reference  to  the  aircraft 
weight  criteria.86  Twelve-five  security  program  requirements  include  passenger 
identification  checks,  fingerprint-based  criminal  history  records  checks  for  flight 
crew  members,  application  of  specific  bomb  and  hijacking  notification  procedures 
and  requirements,  and  implementation  of  a  TS  A-approved  operator  security  program. 
Each  operator  must  designate  a  security  coordinator  within  the  organization,  provide 
training  and  information  to  employees  with  security-related  duties,  and  have 
procedures  in  place  to  coordinate  with  law  enforcement  entities  responding  to 
security  threats.  Although  cockpit  doors  are  not  a  requirement  for  twelve-five 
operations,  if  an  aircraft  has  a  cockpit  door,  procedures  must  be  in  place  to  restrict 
access  to  the  flight  deck. 

In  addition  to  these  requirements  of  the  twelve-five  security  program,  operators 
of  passenger  charter  flights  in  aircraft  weighing  more  than  100,300  pounds  maximum 
gross  weight  or  and  aircraft  with  61  or  more  passenger  seats  must  implement 
additional  security  measures  laid  out  in  the  TS  A’ s  private  charter  program,  including 
a  requirement  for  physical  screening  of  passengers  and  accessible  baggage.87  Also, 
regardless  of  aircraft  weight,  if  a  passenger-carrying  charter  flight  loads  or  unloads 
passengers  at  a  designated  sterile  area  of  a  commercial  airport  (that  is,  beyond  the 
security  screening  checkpoint),  that  operation  must  also  adopt  the  private  charter 
security  program.  The  private  charter  program  prohibits  passengers  from  carrying 
weapons,  explosives,  and  incendiary  devices,  and  requires  that  metal  detectors  and 
x-ray  systems  used  in  the  screening  of  charter  passengers  meet  standards  established 
by  the  TSA.  However,  physical  screening  of  passengers  can  be  conducted  by  TSA- 
approved  private  screeners  and  is  not  typically  carried  out  by  federal  screeners  unless 
arrangements  are  made  to  enplane  and  deplane  from  the  sterile  area  of  commercial 
airports.  Private  charter  operators  of  these  larger  aircraft  must  establish  procedures 
to  prevent  unauthorized  access  to  aircraft  and  other  access  controlled  areas  as 
specified  in  the  operator’s  security  program  and  must  carry  out  a  security  inspection 
of  aircraft  whenever  access  control  measures,  such  a  posted  security  guards  or 
adequate  access  controls  to  aircraft,  are  not  maintained.  In  addition  to  flight  crew 
members,  other  employees  of  private  charter  operating  large  aircraft  that  have 
unescorted  access  to  aircraft  and  secured  areas  must  submit  to  fingerprint-based 
criminal  history  records  checks,  and  security  coordinators  and  crew  members  must 
complete  annual  recurrent  security  training. 

While  the  twelve-five  and  private  charter  security  regulations  specifically  apply 
to  charter  operations,  the  TSA  requires  GA  operators  authorized  to  enplane  or 
deplane  into  the  sterile  area  of  commercial  passenger  airports  to  conduct  TSA- 
approved  physical  screening  of  passengers,  flight  crew  members,  and  their  carry  on 


86  See  Title  49,  Code  of  Federal  Regulations,  §  1544. 101(e). 

87  See  Title  49,  Code  of  Federal  Regulations,  §  1544. 101(b)  and  (f). 
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items.88  While  these  regulations  are  in  place  to  make  allowances  for  certain  GA 
operations  that  might  be  permitted  to  enplane  and  deplane  at  sterile  airport  areas 
while  preventing  the  introduction  of  weapons,  explosives,  or  incendiary  devices  into 
the  commercial  passenger  aircraft  environment,  corporate  and  privately  owned  GA 
aircraft  are  rarely  granted  access  to  sterile  areas.  Also,  while  the  required  adoption 
of  a  twelve-five  security  program  is  only  required  of  charter  operators,  regulations 
stipulate  that  GA  operators  of  aircraft  weighing  more  than  12,500  pounds  maximum 
takeoff  weight  could  be  required  to  conduct  preflight  security  searches  and  screen 
passengers,  crew  members,  and  carry-on  items  before  boarding  in  accordance  with 
security  procedures  approved  by  TSA  if  notified  to  do  so  by  the  TSA.89  While  these 
security  measures  have  never  been  implemented,  they  could  become  effective  upon 
notification  to  operators  through  means  such  as  the  Notices  to  Airman  (NOTAM) 
system  and  may  be  carried  out,  for  example,  upon  receipt  of  specific,  credible 
intelligence  suggesting  a  terrorist  plot  to  hijack  business  jets. 

Airspace  Restrictions 

Besides  efforts  to  tighten  security  at  GA  airports  and  vet  pilots,  GA  security 
measures  have  focused  extensively  on  imposing  flight  restrictions  over  various 
potential  terrorist  targets.  These  security-related  flight  restrictions  have  been  highly 
contentious  because:  they  have  a  direct  impact  on  air  commerce  and  the  freedom  of 
movement  by  air;  the  potential  for  airspace  violations  has  significant  repercussions 
for  both  professional  and  private  pilots;  surveillance,  airspace  protection,  and 
enforcement  of  airspace  restrictions  can  be  costly  and  resource  intensive;  and  these 
measures  are  considered  by  many  to  be  of  questionable  effectiveness. 

Airspace  Restrictions  Around  Washington,  DC.  While  many  low- 
altitude  flight  restrictions  around  sensitive  locations  for  reasons  of  national  security 
have  long  been  in  place,  the  number  and  scope  of  these  restrictions  has  expanded 
significantly  since  the  terrorist  attacks  of  September  11,  2001.  The  most 
comprehensive  of  these  restricted  areas  is  the  airspace  around  Washington,  DC, 
which  consists  of  a  Flight  Restricted  Zone  (FRZ),  15-nautical  miles  in  radius,  and  a 
larger  area  -  referred  to  as  the  Washington,  DC  Air  Defense  Identification  Zone 
(ADIZ)90  -  where  flights  must  adhere  to  specific  flight  plans  and  air  traffic 
communications  and  surveillance  requirements.  An  FAA  proposal91  to  make  the 
airspace  restrictions  around  Washington,  DC  permanent  has  met  with  considerable 
disapproval  from  pilots  and  GA  advocacy  groups  who  had  hoped  these  restrictions 


88  See  Title  49,  Code  of  Federal  Regulations,  §1550.5. 

89  See  Title  49,  Code  of  Federal  Regulations,  §1550.7. 

90  The  term  Air  Defense  Identification  Zone  (ADIZ)  has  long  been  in  place  and  refers  to 
any  area  of  airspace  where  the  identification,  location,  and  control  of  aircraft  are  required 
in  the  interest  of  national  security.  Prior  to  September  1 1 , 200 1 ,  this  term  generally  referred 
to  buffer  zones  around  coastal  waters  and  international  borders  of  the  United  States.  Since 
September  11,  2001,  the  ADIZ  concept  has  been  expanded  to  include  zones  within  the 
United  States  such  as  in  the  vicinity  of  Washington,  DC. 

91  Federal  Aviation  Administration.  “Washington,  DC  Metropolitan  Area  Special  Flight 
Rules  Area;  Proposed  Rule.”  Federal  Register,  70(149),  45250-45261  (August  4,  2005). 
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would  be  eased.  Presently,  the  airspace  restrictions  continue  to  exist  as  temporary 
flight  restrictions  (TFRs)  while  the  decision  to  make  them  permanent  remains  under 
review.  A  detailed  discussion  of  the  airspace  restrictions  in  the  Washington,  DC  area 
can  be  found  in  CRS  Report  RS22234,  Homeland  Security:  Protecting  Airspace  in 
the  National  Capital  Region ,  by  Bart  Elias. 

Security-Related  Flight  Restrictions  Throughout  the  United  States. 

Other  than  the  airspace  restrictions  around  Washington,  DC,  various  security-related 
flight  restrictions  have  been  put  in  place  to  protect  national  security  interests  and 
ostensibly  to  protect  potential  high-profile  terrorist  targets  from  aerial  attacks.  At 
various  times  since  September  11,  2001,  flight  restrictions  have  been  imposed  to 
protect  airspace  around  major  U.S.  cities  and  other  potential  terrorist  targets.  For 
example,  during  the  build  up  toward  the  war  in  Iraq  in  early  2003,  additional  airspace 
restrictions  were  put  in  place  around  New  York  City,  Chicago,  and  Disney  theme 
parks  in  addition  to  establishing  the  ADIZ  around  Washington,  DC  to  augment  the 
FRZ  that  had  already  been  put  in  place  following  the  terrorist  attacks  of  September 
1 1, 2001.  Flight  restrictions  around  major  cities  besides  Washington,  DC  were  lifted, 
but  have  been  reinstated  for  brief  periods  during  times  when  the  national  security 
threat  level  has  been  elevated  or  when  special  events  warranted  the  establishment  of 
temporary  flight  restrictions.  However,  the  flight  restrictions  around  Disney  theme 
parks  have  continuously  remained  in  effect  and  are  now  mandated  in  statute.  In 
addition  to  these  restrictions,  the  Consolidated  Appropriations  Act  of  2004  (P.F.  108- 
199,  Sec.  521)  establishes  permanent  flight  restrictions  over  stadiums  and  motor 
speedways  during  major  league  baseball  games,  national  football  league  and  National 
Collegiate  Athletic  Association  (NCAA)  division  I  football  games,  and  major  auto 
racing  events.  These  flight  restrictions  establish  a  three  nautical  mile  radius  around 
the  effected  facility  extending  from  the  surface  to  3,000  feet.  GA  aircraft  are 
generally  prohibited  from  this  airspace,  but  exceptions  may  be  made  for  flight 
operations  directly  related  to  the  sporting  event,  broadcast  coverage  of  the  sporting 
event,  or  to  provide  safety  and  security  for  the  event.  Exceptions  may  also  be  made 
in  cases  where  the  venue  is  in  close  proximity  to  an  airport,  in  which  case  aircraft 
may  enter  into  the  restricted  area  if  necessary  to  land  or  takeoff  from  the  airport  using 
standard  air  traffic  procedures.  These  restrictions  have  been  criticized  by  some 
because  they  are  selective  in  the  events  that  are  covered  by  the  statutory  mandate  and 
therefore  do  not  encompass  all  large-scale  outdoor  assemblies.  The  restrictions  have 
also  been  criticized  because  the  relatively  small  size  of  restricted  airspace,  while 
often  interfering  with  flight  operations,  is  considered  by  many  to  provide  an 
inadequate  perimeter  for  establishing  adequate  airspace  protections  to  the  sites  they 
are  intended  to  protect. 

Presidential  Airspace  Restrictions.  In  addition  to  the  stadium  and  theme 
park  overflight  rules,  the  temporary  flight  restricted  areas  put  in  place  around  sites 
visited  by  the  President  are  particularly  troublesome  for  many  pilots.  Unlike  the 
stadium  and  Disney  theme  park  areas  which  encompass  a  relatively  small  footprint, 
the  flight  restrictions  put  in  place  for  presidential  visits  encompass  a  much  wider 
area.  The  area  of  these  restrictions  has  grown  from  a  3-mile  radius  extending  3,000 
feet  in  altitude  before  9/11,  to  a  30-nautical  mile  radius  reaching  up  to  18,000  feet  in 
altitude.  This  effectively  increased  the  footprint  of  the  restricted  airspace  around  the 
President  from  just  over  28  square  miles  to  more  than  2800  square  miles,  and 
increased  the  cubic  volume  of  protected  airspace  around  the  President  by  600%. 
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T ypically ,  during  a  presidential  visit,  GA  flights  are  completely  prohibited  within  1 0- 
nautical  miles  of  the  designated  site.  Between  10  and  30  nautical  miles  from  the 
designated  site,  flights  below  18,000  feet  must  be  on  active  flight  plans  and  in 
constant  communication  with  air  traffic  controllers. 

The  fact  that  these  airspace  restrictions  to  protect  the  President  are  often  put  in 
place  with  little  advance  notice  has  the  potential  of  catching  pilots  off  guard. 
Because  these  presidential  movement  temporary  flight  restrictions  (TFRs)  change 
dynamically  with  the  President’s  schedule,  pilots  can  be  easily  misinformed  or 
confused  about  the  specific  location  of  the  restricted  airspace  and  the  effective  times 
of  the  restrictions,  which  usually  includes  a  block  of  time  around  the  President’s 
expected  presence  but  can  change  on  short  notice.  Also,  these  restrictions  are  often 
defined  in  terms  that  may  not  be  meaningful  to  GA  pilots  whose  aircraft  may  lack  the 
navigational  capability  to  identify  the  boundaries  of  restricted  areas.  The  FAA  and 
user  groups  such  as  AOPA  have  worked  to  increase  pilot  awareness  regarding  the 
movements  of  the  President  and  provide  pilots  with  up  to  date  information  regarding 
presidential  movement  TFRs  including  graphical  depictions  of  affected  airspace. 
Nevertheless,  identifying  these  airspace  boundaries  continues  to  be  a  challenge, 
particularly  to  pilots  flying  primarily  by  visual  means  and  relying  on  landmarks  on 
the  ground  to  avoid  airspace  incursions.  The  AOPA  and  other  GA  advocacy  groups 
have  questioned  the  need  for  restrictions  over  such  a  wide  area  and  have  lobbied  to 
keep  the  impacts  of  these  security  measures  on  airspace  accessibility  to  a  minimum.92 

Policy  Issues  Regarding  Airspace  Restrictions.  Besides  these  specific 
objections  to  security-related  flight  restrictions,  many  aviation  interests  and  homeland 
security  specialists  have  raised  broader  policy  questions  about  the  effectiveness  of 
these  various  airspace  restrictions  and  special  operating  procedures,  noting  that 
enforcing  airspace  restrictions  is  costly  and  resource  intensive  and  providing 
protection  to  defend  sites  against  aerial  attacks  is  an  even  greater  challenge.  The 
resource  requirements  and  associated  costs  for  monitoring  restricted  airspace  and 
providing  airspace  protection  around  critical  sites  raise  policy  questions  regarding  the 
appropriate  balancing  of  these  measures  with  efforts  to  address  other  homeland 
security  threats,  and  the  effect  of  these  measures  on  air  commerce  and  the  freedom 
of  movement  by  air. 

Surveillance  and  Monitoring  of  Restricted  Airspace.  Surveillance  and 
monitoring  capabilities  present  a  significant  challenge  for  protecting  airspace.  This 
is,  in  part,  because  detailed  information  on  specific  GA  aircraft  is  not  provided  to  air 
traffic  controllers  and  airspace  monitors  unless  the  aircraft  is  transmitting  a  unique 
identifying  code  to  air  traffic  radar  sites.  Under  the  current  radar  system,  providing 
GA  aircraft  with  unique  identifiers  and  tracking  all  GA  aircraft  could,  at  times,  prove 
overwhelming  for  air  traffic  controllers.  Under  present  day  air  traffic  control 
procedures,  pilots  must  file  flight  plans,  receive  unique  identifier  codes  to  transmit, 
and  make  radio  calls  to  air  traffic  controllers  to  establish  “radar  contact' ’allowing 
controllers  to  identify  and  track  a  specific  flight.  Under  normal  circumstances  in 
clear  weather,  many  flights  never  file  a  flight  plan  nor  contact  air  traffic  controllers 


92  See,  e.g.,  Aircraft  Owners  and  Pilots  Association.  Members  of  Congress  Join  AOPA 
Outcry  Over  Presidential  Movement  TFRs.  Frederick,  MD;  May  16,  2003. 
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because  they  are  not  required  to  do  so.  But,  to  operate  inside  certain  restricted 
airspace  like  the  Washington,  DC  ADIZ,  pilots  must  follow  the  aforementioned 
procedures  for  filing  flight  plans,  transmitting  unique  identifying  codes,  and 
communicating  with  air  traffic  controllers  -  procedures  that  are  often  workload 
intensive  for  both  pilots  and  controllers.  Technologies  may  provide  a  solution  that 
could  ease  pilot  and  controller  workload  associated  with  these  transactions.  For 
example,  Mode  S  transponders  are  capable  of  automatically  relaying  detailed  aircraft 
identifier  information  to  air  traffic  radars,  but  most  smaller  GA  aircraft  do  not  have 
this  technology  and  it  is  expensive  to  install.  Similarly,  emerging  technology  called 
Automated  Dependent  Surveillance  -  Broadcast  (ADS-B)  can  transmit  detailed 
aircraft  information  to  ground  stations  and  other  aircraft,  but  this  new  technology  is 
only  beginning  to  become  available  and  surveillance  capability  is  not  yet  available 
in  all  parts  of  the  United  States.  While  ADS-B  shows  significant  promise  for 
improving  safety  as  well  as  security,  the  FAA  is  still  reviewing  its  investment 
strategy  in  this  technology.  In  the  meantime,  surveillance  of  GA  aircraft  must  rely 
on  current  radar  capabilities,  involving  close  coordination  between  pilots  and  air 
traffic  controllers.  This  imposes  additional  workload  on  both  pilots  and  controllers. 
This  increased  workload  has  a  direct  bearing  on  FAA  resources.  For  example,  the 
FAA  estimates  that  making  the  Air  Defense  Identification  Zone  (ADIZ)  around 
Washington,  DC  permanent  will  cost  about  $11  million  per  year,  mostly  linked  to 
increased  labor  costs  associated  with  processing  flight  plans  and  providing  air  traffic 
services  to  aircraft  operating  under  visual  flight  rules  (VFR)  that  would  otherwise 
present  little  or  no  impact  on  the  air  traffic  control  system.93 

Airspace  Protection  and  Homeland  Defense.  Besides  the  resources  and 
costs  associated  with  monitoring  flights,  the  capability  to  establish  formidable 
airspace  protections  in  restricted  airspace  is  a  central  issue  for  homeland  security. 
The  effectiveness  of  airspace  protections  and  interagency  coordination  in  providing 
homeland  security  and  defense  is  at  the  crux  of  the  policy  debate  over  effective 
airspace  security.  This  is  because  airspace  restrictions  by  themselves  are  not 
particularly  useful  tools  unless  a  coordinated  response  to  protect  critical  assets  within 
those  protected  areas  are  effective.  Merely  relying  on  enforcement  tools  is  not  likely 
to  be  of  significant  benefit  because  terrorists  are  likely  to  care  little  that  they  are 
violating  airspace  restrictions  in  carrying  out  an  attack. 

The  North  American  Aerospace  Defense  Command’s  (NORAD’s)  Operation 
Noble  Eagle  is  charged  with  the  task  of  interdicting  aircraft  believed  to  pose  a 
national  security  risk.  Since  September  11,  2001,  fighter  jets  have  scrambled  to 
respond  to  almost  2,000  domestic  air  security  events.94  While  these  incidents  include 
escorts  of  international  passenger  airliners  where  passengers  names  matched 
information  in  terrorist  databases,  the  large  majority  of  these  interdictions  involved 


93  Aircraft  operating  under  VFR  may,  on  occasion,  request  traffic  advisories  or  “flight 
following”  from  air  traffic  controllers  on  a  workload-permitting  basis.  However,  except  for 
regulations  established  for  security  monitoring  purposes,  VFR  aircraft  are  not  required  to 
interact  with  air  traffic  services  unless  flying  in  specially  designated  airspace  near  towered 
airports  or  above  18,000  feet. 

94  First  Air  Force.  Operation  Noble  Eagle:  Defending  America ’s  Skies.  Tyndall  Air  Force 
Base,  FL. 
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intercepts  of  small  GA  aircraft  that  strayed  into  restricted  or  prohibited  airspace.  In 
the  environment  of  heightened  security  since  the  9/11  attacks,  the  FAA,  NORAD, 
and  aviation  user  groups  such  as  the  AOPA  and  the  NBAA  have  made  extensive 
efforts  to  heighten  pilots’  awareness  regarding  airspace  restrictions  and  proper 
procedures  to  follow  if  intercepted  by  DHS,  law  enforcement,  or  military  aircraft. 

Despite  these  intensified  efforts  to  protect  major  metropolitan  areas  and  critical 
sites  from  aerial  attacks,  it  has  been  reported  that  military  officials  have  concluded 
that  stopping  a  9/11-style  attack  would  be  difficult  unless  fighter  jets  were  already 
airborne.95  Maintaining  a  constant  airborne  defense  presence,  however,  would  be 
extremely  costly  and  resource  intensive.  Ground-to-air  missiles  have  been  deployed 
around  Washington,  DC,  but  are  largely  seen  as  a  measure  of  last  resort  for  protecting 
a  limited  number  of  key  locations  against  an  aerial  attack,  whether  that  attack 
involves  a  GA  aircraft  or  a  commercial  airliner.96 

Because  of  the  continuing  challenges  in  providing  effective  national  airspace 
defenses,  the  adequacy  of  airspace  protection  initiatives  will  likely  depend  on  close 
cooperation  and  coordination  between  the  FAA,  the  DHS,  and  the  DoD  as  well  as 
effective  command  and  control  within  each  of  these  organizations.  Presently,  event 
response  is  coordinated  through  the  FAA’s  Domestic  Events  Network  (DEN),  a 
continuously  operated  unclassified  network  for  sharing  critical  incident  information 
regarding  aircraft  deviations  and  violations  of  security  restricted  airspace,  and  the 
TSA’s  Transportation  Security  Operations  Center  (TSOC),  the  central  hub  for 
exchanging  information  regarding  aviation  threats  located  in  Herndon,  VA.  The 
function  of  these  facilities  is  to  provide  a  shared  situational  awareness  of  aviation 
threats  including,  but  not  limited  to,  threats  posed  by  GA  aircraft.  Besides  the  TS A, 
NORAD,  and  the  FAA,  other  key  agencies  involved  in  airspace  surveillance  and 
protection  include  Customs  and  Border  Protection  (CBP)  and  the  Coast  Guard  which 
provide  air  interdiction  and  situation  response  within  the  DHS  as  well  as  the  Federal 
Bureau  of  Investigation  (FBI).97  These  agencies  also  coordinate  with  federal,  state, 
and  local  law  enforcement  to  integrate  threat  response. 

Coordinated  threat  response  was  observed  in  the  May  11,  2005  event  where  an 
errant  small  private  airplane  penetrated  deep  into  the  FRZ  around  Washington,  DC. 
The  coordinated  response  to  this  threat  included  deployment  of  fighter  jets, 
helicopters  from  CBP,  and  federal  and  state  law  enforcement  assets  to  interdict  and 
intercept  the  aircraft.  While  the  response  to  this  perceived  threat  was  by  most 
accounts  well  coordinated,  concerns  have  been  raised  that  response  to  a  more 
formidable  threat,  such  as  a  faster  moving  aircraft  attempting  to  evade  airspace 
protections  and  defenses  may  be  much  more  difficult  to  interdict  and  may  require  a 
carefully  orchestrated  response  involving  close  coordination  between  responsible 
agencies.  While  these  agencies  continue  to  assess  and  refine  their  monitoring  and 


95  Associated  Press.  “Intercept  Tests  Show  U.S.  Air  Vulnerability.”  January  15,  2004. 

96  Statement  by  Honorable  Paul  McHale,  Assistant  Secretary  of  Defense  for  Homeland 
Defense  before  the  Committee  on  Government  Reform,  United  States  House  of 
Representatives,  July  21,  2005. 

97 


Ibid. 
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response  capabilities,  Congress  may  continue  to  conduct  oversight  of  interagency 
coordination  to  ascertain  whether  there  is  an  adequate  level  of  preparedness  to  deal 
with  airborne  threats,  including  threats  posed  by  GA  aircraft,  and  assess  whether 
steps  taken  to  protect  critical  assets  from  aerial  attacks  do  not  unduly  burden  GA 
operators  or  compromise  flight  safety.  While  the  focus  to  date  has  been  airspace 
protection  in  and  around  Washington,  DC,  Congress  may  also  examine  whether  the 
capability  and  coordination  between  federal,  state,  and  local  agencies  to  monitor  and 
protect  airspace  in  other  areas  of  the  country  is  adequate  and  appropriately  balances 
homeland  security  needs  with  air  commerce  and  aviation  safety  concerns. 


Related  Legislative  Actions  in  the  109th  Congress 

GA  security  has  been  a  topic  of  continued  legislative  interest  in  the  109lh 
Congress.  Based  on  a  Senate-passed  amendment  introduced  by  Senator  Clinton 
(S.Amdt.  1106  to  H.R.  2360),  conference  report  language  in  the  FY2006  DHS 
Appropriations  Act  (P.L.  109-90)  requires  the  DHS,  in  coordination  with  the 
Department  of  Transportation,  to  “...study  the  vulnerability  posed  to  high-risk  areas 
and  facilities  from  general  aviation  aircraft  that  could  be  stolen  or  used  as  a  weapon 
against  those  areas.”  Areas  to  be  considered  in  the  assessment  include  critical 
transportation  infrastructure,  nuclear  facilities,  military  bases,  and  highly  populated 
areas  with  similarly  situated  critical  infrastructure.  The  analysis  is  to  identify 
vulnerabilities  at  GA  airports,  the  sufficiency  of  existing  security  measures,  and  any 
additional  security  measures  that  could  be  implemented. 

Additional  legislation  introduced  in  the  House  would  focus  on  site-specific 
measures  to  improve  security  at  GA  airports.  The  Strengthen  Aviation  Security  Act 
(H.R.  2649),  introduced  by  Representative  Markey  on  May  26,  2005,  would  require 
airport  operators  to  develop  site-specific  vulnerability  assessments  for  each  GA 
airport  and  develop  a  plan  for  addressing  vulnerabilities  identified  within  one  year 
of  enactment.  H.R.  2649  would  also  require  background  checks  and  terrorist 
database  screening  for  any  individuals  with  access  to  general  aviation  aircraft.  While 
the  bill  language,  in  its  broadest  interpretation,  could  apply  to  just  about  anyone  who 
would  have  occasion  to  visit  or  transit  through  a  general  aviation  airport,  the  intent 
appears  to  be  focused  on  airport  workers  and  pilots  to  parallel  requirements  for 
unescorted  access  to  secured  areas  of  commercial  airports.  The  bill  would  also 
require  all  GA  aircraft  to  be  secured  by  visible  immobilizing  devices  such  as  prop 
locks  while  parked  at  GA  airports. 

In  addition  to  these  measures,  H.R.  2649  calls  for  establishing  no-fly  zones 
during  periods  of  high  terrorist  threat  levels  and  any  other  applicable  times  identified 
by  the  DHS  around  all  sensitive  nuclear  facilities,  chemical  facilities  where  a  release 
of  hazardous  materials  could  endanger  one  million  or  more  lives,  and  any  other 
facilities  designated  by  the  Secretary  of  Homeland  Security. 

On  July  21,  2005,  Representative  Sweeney  introduced  the  General  Aviation 
Security  Act  of  2005  (H.R.  3397).  This  bill  would  require  all  operators  of  public  - 
and  private-use  airports  in  the  United  States  to  register  with  the  DHS  and  undergo  a 
registration  renewal  process  every  three  years.  The  proposed  registration  process 
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would  include  a  security  plan  documenting  site-specific  security  procedures 
consistent  with  the  TSA’s  most  recent  security  guidelines  for  GA  airports.  In 
developing  security  plans,  operators  would  be  required  to  provide  a  written 
description  of  how  the  airport  has  addressed  each  recommendation  or  justify  why  a 
particular  recommendation  was  not  adopted.  The  legislation  calls  for  using  self- 
assessment  tools  to  identify  airport  characteristics  for  security  purposes  in  the 
development  of  airport- specific  security  plans.  In  addition  to  providing  security 
plans  to  the  DHS  as  part  of  the  registration  process,  airports  would  also  be  required 
to  submit  their  security  plans  to  local  law  enforcement  agencies  having  jurisdiction 
over  the  airport. 

H.R.  3397  would  also  require  that  all  public-use  airports: 

•  Ensure  that  all  aircraft  crews  verify  the  identity  of  all  aircraft 
passengers; 

•  Maintain  logs  of  all  transient  aircraft  for  a  minimum  of  five  years; 

•  Make  a  list  of  emergency  telephone  contacts  available  to  all  airport 
personnel; 

•  Restrict  the  access  of  unlicensed  individuals  and  student  pilots  to 
aircraft  keys; 

•  Require  aircraft  renters  to  present  government-issued  identification 
in  addition  to  their  pilot’s  license; 

•  Post  applicable  security  warning  signs  and  advisories  where 
appropriate; 

•  Provide  emergency  responders  with  confidential  emergency  locator 
maps  of  the  airport  identifying  items  such  as  runways,  ramp  areas, 
fence  lines,  and  gates;  and 

•  Familiarize  local  law  enforcement  with  the  airport  and  consult  with 
them  in  developing  security  procedures. 

Additionally,  at  all  GA  airports  -  both  public-  and  private-use  -  all  aircraft 
would  be  required  to  be  double-locked  with  one  external  lock  and  one  lock  inside  the 
aircraft.  Also,  at  all  GA  airports,  hangars  would  be  required  to  be  locked  when  not 
in  use  and  adequate  fencing  would  be  required  for  secure  areas. 

Besides  these  more  comprehensive  measures  addressing  GA  security,  concerns 
over  airspace  violations  that  complicate  the  task  of  protecting  critical  assets  from 
aerial  attack  have  prompted  the  introduction  of  legislation  calling  for  stiffer  fines  for 
airspace  violators  and  mandatory  pilot  training  on  airspace  restrictions.  In  response 
to  concerns  over  frequent  violations  of  restricted  airspace  near  Washington,  DC, 
Representative  Blunt  introduced  the  Capitol  Airspace  Enforcement  Act  (H.R.  3465). 
The  bill  calls  for  civil  penalties  ranging  from  $10,000  up  to  $100,000  for  violations 
of  the  15-mile  radius  flight  restricted  zone  (FRZ)  around  Washington,  DC,  and  fines 
of  up  to  $5,000  for  violations  of  security  protocols  while  operating  in  the  larger  air 
defense  identification  zone  (ADIZ).  The  measure  also  includes  a  requirement  for 
mandatory  pilot  training  regarding  the  airspace  restrictions  and  proper  operating 
procedures  and  compliance  with  airspace  restrictions. 

While  GA  advocacy  groups  like  the  AOPA  and  the  NBAA  support  mandatory 
education  for  pilots  flying  in  and  near  restricted  airspace  and  have  taken  considerable 
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steps  on  their  own  initiative  to  provide  educational  materials  regarding  the  airspace 
restrictions,  they  strongly  oppose  stricter  penalties  and  believe  that  administrative 
actions  and  fines  already  available  to  the  FAA  along  with  the  potential  threat  of  a 
shoot  down  already  serve  as  sufficient  deterrents  for  inadvertent  airspace  violations.98 
These  groups  have  voiced  significant  concerns  over  the  impact  of  airspace 
restrictions  and  homeland  security  regulations  on  air  commerce  and  the  freedom  of 
movement  by  air.  These  groups  have  also  opposed  comprehensive  legislative 
measures,  such  as  H.R.  3397,  that  mandate  broad  security  requirements  over  the  wide 
range  of  GA  airports  and  operations  cautioning  that  imposing  such  mandates 
“..  .would  be  ridiculously  expensive,  is  unnecessary,  and  ignores  the  guiding  principle 
of  making  investments  in  security  based  on  risk.”99  In  response  to  this  criticism, 
attempting  to  tailor  homeland  security  policy  to  fit  the  risk  posed  by  widely  varied 
GA  operations,  allocating  budgets  and  resources  to  address  security  priorities,  and 
addressing  concerns  about  potentially  impeding  air  commerce  or  compromising 
aviation  safety  are  likely  to  remain  ongoing  challenges  for  the  Congress. 


98  Spencer  S.  Hsu.  "Bill  Targets  Errant  Pilots.”  The  Washington  Post ,  August  22,  2005,  p. 
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99  Aircraft  Owners  and  Pilots  Association.  Congressional  Bill  Threatens  GA  With  Expensive 
Security  Mandates.  Frederick,  MD  (July  22,  2005). 


